Very easy, if its not authorized it's not a pentest or red team operation.

Any pentester or red team considers their profession an ethical one.

By the response of the Linux Foundation, this is clearly not authorized nor falling into any bug bounty rules/framework they would offer. Social engineering attacks are often out of bounds for bug bounty - and even for authorized engagements need to follow strict rules and procedures.

Wonder if there are even legal steps that could be taken by Linux foundation.