In theory, the difference would be intent. If you proceed to inform others of the vulnerability or exploit it yourself to share secrets, the malicious intent is hard to deny.

If you just click around to see what the site has to offer, it becomes harder to prove. Some places have passed laws banning the mere accessing of content that should not be accessible, thereby putting the burden of proof on the defendant to show that they did not know the link would lead to confidential information, made no attempt to extract it, immediately withdrew upon realisation and so on.

On one hand, brief amd harmless access might not be worth legal action anyway, unless actual damage was done, so the expectation is probably that discretion in enforcement would moderate the heavy-handedness of the law. That isn’t exactly unusual: It’s easier to let something slide than to punish a transgression there is no law against.

One the other, trusting the fairness of that system might not be a good idea…