I think the main factors which differentiates stumbling from an illegal activity is the fact that netstumbler does not search for beacons. It only listens for broadcasts from AP's in its area. If someone yells a "secret password" out the window to someone across the street am in the wrong for hearing it while I walk by? I think the only line, which may come to cross, is our disclosure of what we find to the companies in question. Some choose to let them know they’re vulnerable, and some just choose to make it known to the community. Either way you go about it that is a different topic.