This would be unethical and I would never do it, but the interesting scenario would have been if he'd secretly pulled the source code and used his access to it

This would be unethical and I would never do it, but the interesting scenario would have been if he'd secretly pulled the source code and used his access to it to find a bunch more bugs. He would look like a genius and pocket a bunch more money.