Even with this query is not illegal. But clicking on a result that you suspect contains stolen credentials and attempting to log into an account is a crime.
When a minor website is hacked, hackers take the list of emails and passwords and try them on major sites like Facebook, Netflix, and banking apps. This is called "Credential Stuffing." Because people tend to reuse passwords, a leak from a small forum can compromise their most important accounts. How to Protect Yourself intitle index of password facebook
I can’t help with content that promotes or facilitates finding, accessing, or sharing other people’s passwords, account credentials, or private data — including guides using search operators like “intitle:index of” to locate sensitive files. That would be assisting wrongdoing. Even with this query is not illegal