He didn't. Also, he made a phone call and made every effort to give the benefit of the doubt to someone who, perhaps not maliciously and through naiveté, did something very silly and then made it even sillier by making it look hard to distinguish from extortion.

The best possible outcome there would have been a grumpy letter from lawyers asking him to sign an affidavit he's destroyed all the data he picked up. The worst would have been people in suits packing away his every computing device at 4 am. None of this happened and it seems the main reason it didn't is 'Alex Stamos is not a dick and Facebook lets him not be a dick'. That's a good outcome, by any measure.