As someone involved in bug bounties, this was completely different from a traditional bug bounty reward. Uber disguised this payment as a "bug bounty" to hide what it actually was -- a ransom payment to get the hacker to destroy the data. If this were truly under the realm of bug bounties, the hacker would have violated Uber's policies for exploiting the flaw and extracting information (the reward also exceeded Uber's top payout tenfold).

In short, the issue people are taking with Uber is that they tried to pass off a security breach as having taken proactive measures, while this was a case of ransom.

But if he found them, then someone else could have _already_ found them and downloaded the data.

The problem isn't that Uber paid him for finding the vulnerability, but that Uber kept it secret for so long.

That doesn't make sense. Serverside RCEs get disclosed all the time. If you take the median large SFBA tech company and stipulate serverside RCE, you're almost 100% of the time going to be an hour or two away from breach-disclosure-law event. But that never happens. What was different in this case?