They didn't necessarily pick that, though. When you submit a vulnerability to a company that doesn't have such a program in place, it is their choice as to whether that falls into the "free" or "paid" category.

Yahoo's reaction put it into the "paid" category, and then paid an insultingly low amount. That was their error. A different reaction, even just different wording when sending the gift card, could have put it into the "free" category.

You can see it as an insultingly low payment or as a bigger than usual thank you. If you expected nothing, the shirt is a pretty decent thank you. If you expected to be paid, the shirt is an insult. Clearly the people who bitched about the shirt expected to get paid. So they had already put their work in the "paid" category and then complained when the pay was low. It sounds like a lot of other people didn't expect anything and put their work in the "free" category and were (at least a little) pleased to get an unexpected thank you.

You are misunderstanding things. A dollar amount automatically puts it into the paid category, because it is comparable.

You are misunderstanding things. It used to just be an actual t-shirt. But people who already had a t-shirt said they didn't need another one. So an equivalent amount of store credit was given to get something other than a t-shirt. I guess he could have just offered for them to pick from a few different schwag items. Any physical item as a thank you is going to have some sort of dollar value... but I still don't think that automatically puts it into the paid category.