While not explicitly illegal, I was building out part of a product for an international company with a massive userbase (hundreds of millions) and discovered a slight issue: their api required no authentication, had no rate limiting, and an easily discoverable request format. Anyone could make a simple request with a handful of digits and get a complete history of that product, revealing very intimate details about the users in every aspect of their lives.
I don't get nervous easily but it made my stomach turn, my palms started sweating. I told my boss, we told our boss, who went and pulled the CEO out of a meeting. I was given signed documentation on company letterhead that stated I raised the issue and also detailed how our company had informed the customer, along with a modest cash bonus and they bought me most of the furniture in my house (no taxes!)
The company came back to us and said "we know, we built it like that on purpose". Incredulous but reassured that both myself and my employer were not facing any liability, I finished the product and it shipped. Predictably this was exploited within a few years and made national news when it was used against prominent political figures.
There are still no legal mechanisms in place to enforce any kind of security for this class of product.