Good RoE practice and data minimisation principles require that testers avoid unnecessary further access to or extraction of sensitive data discovered incidentally, document the finding at a level of detail proportionate to demonstrating the risk (without excessively reviewing or copying the sensitive content itself), and follow the agreed escalation process so the client can assess and address the underlying access control weakness.
Extensively reviewing and downloading the data merely because access was technically achieved (A) breaches minimisation principles and increases risk unnecessarily; ignoring a significant, relevant finding (B) fails the client and undermines the value of the engagement; and unilaterally deleting client data (D) is a serious, inappropriate action that a tester has no authority to take and could itself cause real harm or evidentiary problems.