I'm not sure that the researcher did any actual damage? I guess they could have taken over one domain to show the vulnerability rather than all of them. But, i

I'm not sure that the researcher did any actual damage? I guess they could have taken over one domain to show the vulnerability rather than all of them. But, if anything, they did the work to collate a useful set of abandoned domains, and all DO needed to do was say "thanks, we've moved them to a special account we've set up and sinkholed on our own server". Of course, then DO would be liable for the sinkholing, so maybe they thought it better to lock this guys account ("we did our best to prevent the hacker") and kick the actual issue into the long grass.