now, that should teach him to sell those on black marked instead

I'm mostly joking here, but Microsoft is one of few companies that handle cyber security in a way that really incentive people to not report them.

it's either by downplaying impact and not paying or paying very little or doing other researcher hostile activities.

especially that someone here mentioned some time ago that black market pays about 3x for the same class of vulnerability, so you need fairly high moral standards to go direct way