Additionally, their bug bounty program, like most/almost all, is designed for reported security-related bugs. They made an exception here, which they had no obligation or expectation to do. I'm sure the modder wasn't anticipating any kind of financial compensation when they embarked on this.