It's kind of fascinating how large corporations can end up acting like petulant children against their own interests and stated goals. We don't know who said or

It's kind of fascinating how large corporations can end up acting like petulant children against their own interests and stated goals. We don't know who said or did what in this situation, but as TFA says, even if the researcher was a maximally bad actor, MSFT's public response hurts their interests. Sometimes individuals behave like petulant children but for a well-run corporation it's a failure mode. In my experience, corps sometimes behave this way not because it's the 'corporate intent' but simply due to internal politics and ass-covering by individual middle managers. MSFT's response is puzzling because it doesn't clear up anything nor does it try to de-escalate. It's also not the sort of completely neutral statement made when you need to respond but have nothing to say yet. This statement implies the researcher is a bad actor while also being vaguely threatening. I can't imagine any way this benefits MSFT. It appears more like a junior exec trying to manage the optics so it looks like their department isn't in the wrong. This ass-covering accomplishes nothing for MSFT. Even if the researcher was demanding payment for a vuln and wasn't producing sufficient justification for their demand or wasn't following the process, this isn't a productive response. It sounds more like a manager is worried what their boss thinks. The manager acting this way is bad but the root cause is often the manager's upline creating a context where managers feel they need to ass-cover and stage manage optics.