If nothing has been changed on the website then it is good in a way to point out insecure websites. Although I believe that if there is a flaw in a website's security then the admin should be notified rather than defacing it just to get bragging rights.