That's how these things typically work. So long as he explored the vulnerability and reported it ethically - and there are both laws and industry norms about th

That's how these things typically work. So long as he explored the vulnerability and reported it ethically - and there are both laws and industry norms about that - than typically a small cash bounty is paid if the bug is serious. This is because you want hackers to report vulnerabilities to you so you can fix them. It's more like returning someone's wallet. You give the person a couple of dollars for their trouble. A company like Amazon, you definitely expect them to have an explicit bug bounty program. This system is good for both consumers and businesses and there's no reason, even if purely from a business calculus perspective, not to throw someone a few bucks for the professional reporting of a vulnerability.