"all he did was scrape PDFs for mostly public funded / tax funded papers"

He wasn't a security researcher. He broke into a room and used equipment to steal information. It wasn't just 'tax funded papers'. Companies invested millions of dollars into some of this research.

We shouldn't support theft and he should have gotten some jail time/punishment for it.

"There should really be laws for protecting security researchers who produce 0 harm and divulge / share a vulnerability with a service provider. I'd rather the floor be getting no money AND not going to jail or being sued."

Too many 'security researchers' demand money or threaten to release the vulnerabilities.

I don't know anyone that got into trouble going through a legit bug bounty program.