Right, this feels like a way for Facebook to simply not payout a bigger bounty after they realized how big an appropriate bounty would be. If the author submit

Right, this feels like a way for Facebook to simply not payout a bigger bounty after they realized how big an appropriate bounty would be. If the author submitted the RCE, and nothing else: is someone at Facebook actually going in and trying to simulate what he actually did? Who knows, because the process is pretty opaque. If you argue with Facebook's assessment, and go and further exploit the system to say "no, this is actually how bad the RCE is, in the grand scheme", you've now actually gone and proved what can be done, against their guidelines, which potentially disqualifies your initial discovery altogether.