Facebook really doesn't need to save $10k by not paying this guy. It's about upholding the terms and not setting a precedent. The blackhat market for Facebook

Facebook really doesn't need to save $10k by not paying this guy. It's about upholding the terms and not setting a precedent. The blackhat market for Facebook exploits is not huge because the product is centrally controlled and can be patched at any time. It's not like 0-days for products with individual installations that aren't centrally controlled with forced updates - those are clearly valuable.