I wonder if Lastpass didn't respond to him because he reported some low-quality non-security bug that wasn't even reachable in practice, like he did with 1Password.

Some people who identify as security researchers are notorious for doing this, hyping up a crap finding that has no real-world implications, refusing to do any sort of root cause analysis or impact assessment, yet expecting vendors to bend over backwards for them.

Here's a tip for security researchers: don't make vendors wade through mountains of shit to find nuggets of gold. Put a reasonable amount of effort into checking if what you think you've found is at all exploitable or makes any difference whatsoever.