> It's not breach for the researcher. The researcher(s) themselves need legal basis to obtain this information which would likely be "legitimate interest" and then follow the other principals of GDPR (like deleting the data when no longer needed).

Good luck arguing that you had legitimate interest in data of people who did not consent to you having it in the first place.

The GDPR does not have a 'legitimate interest' category that includes exploiting breaches. White hat hackers are neither processors nor controllers and can never claim legitimate interest in the data.