Yahoo is free to do whatever they want. I think that's obvious. My opinion from the sidelines reflects what I think it looks like. Certain things become the norm, for e.g. someone finds $100K and returns it, the norm is to pay them a nice reward for doing so. There is absolutely no agreement or law in place that says they have to get anything in return. In fact, neither I nor most people I know expect anything in return for doing the right thing. What would your reaction be if the finder received nothing?

Just in case you want to know where I stand: if I find $100K in cash and there is no way to trace it back to me I'm not returning it. However, that is different to finding a bug and selling it for monetary gain.