There's nothing obfuscated about this. It's very straightforward. Yes, he found a security vulnerability. That doesn't earn you points "just cause." You still need to report it with responsible disclosure and not exploit it for the lulz and attention.
He could have done things differently - especially, he could have asked to talk to a Facebook employee who understands Arabic. Or tried to put more effort into a second security report.
Frankly, posting on Mark Zuckerberg's wall about this is childish and just attention-grabbing. It's not a responsible disclosure.
As such, they should be a bit more understanding when someone that speaks Esperanto submits a bug without doing so in a way that perfectly adheres to their terms of service. They should step back and take a subjective view instead of trying to make it black and white. Was he acting maliciously? Did he knowingly violate the terms or was it out of ignorance? Was he trying to hurt Facebook by violating the terms or help them?
The onus is on the organization, not the bug reporter, to vet the information. From what I see, there was more than enough in the report to conclude there was a problem, and follow up.
If Facebook security fails in coding the application, in QR, and when a user files a bug report, it is awfully hard to place the blame with the bug reporter.