People regularly post credential dumps on Pastebin, which can be publicly and freely seen, but that doesn’t make those credentials legal to use.

If the journalist had received copies of the video that someone else had downloaded, he’d be in the clear, and that other person would be on the hook.

If the credentials were posted publicly by the news site as a shared login, and the site simply didn’t realize that these videos were accessible with those credentials, he would likely prevail. Otherwise, he is likely guilty of hacking under current US laws.