It's not.

Germany is way worse.

Yeah seriously, people talk about the UK's defamation law being bad, but in Germany you can get in trouble simply for insulting someone or making a rude gesture (Beleidigung).

In Korea, defamation is a criminal charge and you may be sentenced to 5 years in jail if guilty. As a lovely cherry on top, truth is not a defense, although it does lower the maximum sentence to 2 years.

https://seoullawgroup.com/defamation-laws-in-korea/

Yes, in the EU he would simply be serving time, with little to no lawyer involvement from the companies - the government would have taken care of the whole thing.

The Dutch public prosecution doesn't prosecute when responsible disclosure guidelines were followed. For the computer fraud part obviously; card fraud would be investigated (and there's no helping that this person will be a suspect, but without evidence or motive that should not be a big deal). That's not "this person would simply be serving time". Quite the opposite.

Can't speak for other European countries, I'm not familiar with their practices, but I haven't heard in recent years that anyone got prosecuted for responsible disclosure. A few months back a company started a civil case: that was unusual enough that it made the news (and it was dropped). About a year or so ago, someone was convinced while claiming to be white hat, but they emailed the company something like "pay me and I'll tell you what the problem is. Wouldn't want reputation damage now would we?" Again, unusual enough that it makes the news, and in neither case was a legit white hat "serving time".

This is beyond delusional. Absolutely no evidence or case studies to support this.