That's a false dichotomy.

Also, pentesting sites without their consent is a poor choice to begin with, which is closely linked to why the "I was just trying to help" defense works so poorly.

Deciding to "have some fun" by exposing people's private information and profiting from that "fun" are pretty terribly hobbies.