In advance: I don't think the kid should be charged (and there is no evidence the kid is being charged).
That said: I vote that people learn what responsible disclosure is.
26/12/2013: Kid e-mails PTV (which e-mail address? who knows) to report vulnerability. This is a public holiday in the middle of a peak holiday period.
08/01/2014: The Age newspaper reports on the story, saying that it contacted PTV after the kid contacted them, waited for PTV to fix the issue, and then published.
That's 2 weeks total in the middle of peak holiday period before reporting the vulnerability and publishing, and between the kid notifying The Age, there was time for The Age to contact PTV and PTV to fix the issue. The Age article said that the kid contacted them after not hearing back from PTV for 'over a week'.
Here's the issue: It is unclear whether the e-mail was ever received. Was the e-mail address being checked during the holiday period? Who knows. Did someone receive the e-mail and not know how to deal with it, or think that it was a scam e-mail? Who knows. I believe responsible disclosure should include reasonable efforts to ensure that the notification was received. A follow-up e-mail would have been a good step towards that.
Maybe the kid went to reasonable lengths to ensure that the notification had been received, but none of the articles make it sound that way - and these articles seem to favour his position, so you'd expect that to be clear if it did happen.
In summary: If PTV did actually receive the e-mail (i.e. it actually entered one of their mailboxes, which it very likely did) then the recipient should have passed it onto an appropriate person. PTV should then have responded to the kid acknowledging the problem and providing a (reasonable) estimate of time-to-fix. Assuming the estimate was indeed reasonable, then the kid should have waited for that time prior to contacting The Age. The kid shouldn't be charged, but we should stop pretending that what he did was reasonable or sensible for someone who refers to himself as a 'white hat'.
Edit: I managed to type my dates incorrectly. Thanks for pointing that out @euansmith