What's immoral is allowing the company to leave the vulnerability unfixed. It's their system, their vulnerability is their responsibility. They should be glad they were contacted by a relatively harmless person and pay them a fair value for doing work they didn't even know they needed. If they refuse to fix it, the moral thing to do is to disclose it so that the company has no choice but to fix it.