The point of the vulnerability was, it wasn't even designed to be malevolent. The application simply had a hole that every application had, under certain circumstances, and he was demonstrating it. I imagine that he was as interested in fixing his app as every other developer is!