The legal threat letter from the vendor is among the most insane examples I've read. They only consider something a valid vulnerability if the reporter can demo

The legal threat letter from the vendor is among the most insane examples I've read. They only consider something a valid vulnerability if the reporter can demonstrate they obtained the equipment through a legitimate recorded sale? What on earth does that have to do with the existence of a vulnerability?