Disagree. 10k seems low considering the value to those who ship OSINT services this would have had. Such services get data from very interesting places.

I also wouldn't call it just a server-side web bug, it's more like data exfiltration. TFA author could have sold it for more money to some gray market dudes if he were willing to accept bitcoin.