Yeah .. that thought occurred to me as well.

I wonder if there's a way that you can legally monetize the process, so the organisation who left a gaping hole .. or several bazillion in this case .. gets an education in corporate security and the researcher gets paid for their efforts. A corporate symbiosis if you like.

If course the non legal way is extortion .. but that tends to go towards warfare and mutually assured destruction, rather than collaboration.

Perhaps this opens the door to a white hat penetration testing department at the corporate regulator who issues fines (which pay for the work) .. but I'm not seeing any evidence of an appetite for anything even remotely resembling such a set-up anywhere on Earth.

Espionage on the other hand ..