I'm no security researcher and have def never found a zero-day , but I think this is the thinking in the industry I identify with. Someone went out of their way

I'm no security researcher and have def never found a zero-day , but I think this is the thinking in the industry I identify with. Someone went out of their way to research this vulnerability and spent time on documenting and testing it. They then have the ability to own whatever infrastructure this leaves opened. So, they did the security teams job and helped out. They then take time to repeatedly contact you with sufficient documentation and the offer for more of their time for free to walk you through it. Twice. Security consultants get paid a lot of money and this service is offered for free of charge because of some hackers curiosity. The next step is not usually full disclosure but often, "I have written this blog post detailing the vulnerability and intend to post it in N days unless I hear from you" Then it is pretty fair game for full disclosure.