Was the right outcome achieved in the end? Move on.

If this is the way you treat people who report vulnerabilities, next time they're going to report them to the black market, not you. It's incredibly short sighted.

The black market isn't going to care about it. It isn't really exploitable.