From my own experience, actually making the purchase is likely to be perceived negatively. He had already successfully demonstrated the race condition allowing

From my own experience, actually making the purchase is likely to be perceived negatively. He had already successfully demonstrated the race condition allowing the transfer, so he had enough to clearly make his point. That stated, were I in Starbucks' position I'd lead with a big "thank you" before explaining the liabilities and why he shouldn't go so far to make his point in the future. Also, in the interest of full disclosure, I should state that my team has interacted with Homakov on a number of Chrome vulnerability reports. In my experience he's very sharp, he finds interesting bugs, and my impression is that he's generally trying to do the right thing. However, I can definitely see how his communication style might not come across very well, particularly to a security team that's not used to dealing with the security research community.