It depends what you do next.
If you say, "as a precaution I have acquired the domain names we were talking about. Please send me your details so that I can transfer the registration to your organisation ASAP, or if you prefer we can manage them for you", then you've jumped the gun and intruded slightly on a decision that really is the client's to make, but hopefully no serious harm done. You may have been careless, if the client would have made a different decision from what you made, but I think not immoral.
You should not necessarily expect to be reimbursed for them, especially if the client decides to use someone else (or to cancel the exercise entirely, or use fewer variants than you registered), since you weren't asked to do it in the first place.
You can't be sure you've done the right thing, since there may be disadvantages to registering now. Just for one example, if the domain registrations are listed in a whois directory, then you've made a publicly-available statement that your name and address are somehow involved with the new brand. Albeit not a very direct statement, or one you can easily profit from, but still. You can undo that if it's not appropriate, but undoing something bad doesn't stop it being bad in the first place.
If you say, "I have acquired the domain names, now let's talk about how much you're willing to pay me for them" then it's at least as immoral as any other domain-squatting, and I'd say rather more so since you acted on the specific and commercially-sensitive knowledge that your potential client would want those domains. NDAs establish that information is confidential and/or proprietary, but it doesn't follow that anything not under NDA is not proprietary, nor that it's always proper to act on it. I think in this case it isn't proper to squat a domain that your potential client discusses with you. To avoid squatting you can't demand payment for the domain, not even what you paid for it.
We thought we were protecting him from domain lookups that buy the domains you search for.
Then fine. Follow through doing that, by transferring the domains to the client or their other designated agent as smoothly as possible. But as a general principle, don't expect to be reimbursed for unsolicited services no matter how helpful you expect you're being.