This, exactly this.

The "unlocked door" analogy is wrong. It does not reflect what actually happens with a database in this type of situation. In the real world, houses and doors and windows don't just appear out of nowhere. An unlocked door and window doesn't abruptly allow a person to glance in the house and see someone grunting on the toilet. You don't wake up one morning, look out your window, and see that the scenery has changed. And even if construction did appear across the street, the contractors aren't going to come up to you and order your eyes sewn shut because you glanced over and saw.

But when it comes to computers and the internet, you absolutely can pull up a window and you're seeing the wrong damn thing staring you in the face. Or maybe you see something that looks curious, but you don't have enough information from a name to determine what you're looking at (everyone has seen cryptically-named files on a network drive)...so you get a little closer to see what the hell is happening.

And audit logs aren't like security cameras. A security camera at a corner gas station will differentiate between John Doe paying for his gas and buying a coke, and Chad Doe walking in and aiming a gun at the cashier. There's enough information there to see the difference. But audit logs can be very sparse sometimes, they're just stupid text files; they might record something like "John Doe entered" or "Chad Doe entered" without specifying one was paying for gas, and the other was robbing the station.

So, in the end, someone seeing records they shouldn't see due to improperly working permissions is NOT like taking a prybar, forcing a door open when "no tresspassing!" signs are plastered. It's completely different because the structure of how computers work, and what is or isn't possible, is different.

Additionally, an IT guy's responsibility is to assess the extent of a breech, record where he or she can see wrong data being returned. This is a necessary part of the process to document an issue so it can be moved higher up the chain. Saying this is a part of the crime is like arresting a police detective because they found clues at a crime scene in the execution of their duties, and recorded it as evidence. You're not going to go to that detective and go, "Well, SINCE YOU KNOW SO MUCH, you've obviously guilty!" No, he's not unless you actually have evidence of saving information or bringing it home with him or removing evidence from the evidence lockers. He's doing his job to document the problem so it can be fixed.