If his goal was to keep the data he wouldn't have reported it?

That doesnt necessarily track. He could have stolen the data, then reported it to clear his own name. He did access more data than he needed to prove that there is a likely breach.

His name didn't need clearing.

How will you ensure the other people who were exploiting the hole have deleted their copies?

What a weird way to think about this.

Is it? if 10 people may have committed a crime, should we exonerate 1 of them because he reported it and promises he didnt do anything?

That depends on provable intent,

and your societal goals for ensuring the next exploit is reported, not ignored or shared online.