Don't confuse altruism with good faith. He was obviously not being altruistic - he wanted to be compensated for the vulnerability he had found - but he was not

Don't confuse altruism with good faith. He was obviously not being altruistic - he wanted to be compensated for the vulnerability he had found - but he was not being malicious in his TOS-violating behaviors. There was no intent to cause damage, to exploit the bug for personal gain, or to otherwise be a bad actor. That is what "acting in good faith" means; the things he did were benign and intended to bring the issue to Facebook's attention. The fact that he wanted to be compensated for his discovery doesn't diminish that.