Seems like he just reported URLs of publicly available admin pages. If that was in the scope and considered as a bug by Uber, he should be paid. But the scope

Seems like he just reported URLs of publicly available admin pages. If that was in the scope and considered as a bug by Uber, he should be paid. But the scope change in general doesn't seem that shady, since they probably wanted to get it out of the scope as soon as possible if it's not really a bug.