He is probably a relatively inexperienced programmer. But who cares? The main accomplishment / item on display here is the identification of a vulnerability in a high-value target (supposedly - I haven't verified it), not the PoC.