Disclosing the vulnerability isn't a credible threat because Facebook essentially lets you disclose the vulnerability anyways. We are commenting on a thread about a dude who disclosed a vulnerability after getting a $7000 bounty.