It's actually very easy: If you are in a server, you report it. You don't go digging for more, because once you're in, you can easily do more damage.
What are we supposed to conclude from this? Under the current rules and assuming the description of what happened is accurate, it would seem you'll potentially be punished for establishing the full extent of a breach, unless it's not so bad, in which case you're rewarded for failing. In addition to being illogical and unfair, it also incentivizes OpSec to delude themselves and everyone else about their true security risks.
In the other case, they threatened because he proved the vuln was much much greater, infact I call it a billion dollar bug,and wanted to cover it up.
This time they're proudly telling us because the attempts failed or were not made at all.
As Wes proved, a simple looking RCE can lead to a huge breach of security due to failures in other areas.
I agree that limits must be established, but also, these must not end research so abruptly as they can lead to further information.
One might argue this is unethical, but a black hat doesn't care either way.
It's already a critical vulnerability. Unless you want to assign numbers to the infinity, which is ridiculous.
That's why some get a 10k payout and others get a 2.5k.
I agree that some actions are u ethical, but does that really matter so much when a black hat is unethical anyways? The fact that he reported meant he was harbored no malicious intent.
How is collecting logins better than that? Seriously? This is completely malicious if you ask me.
Moreover, we must not judge each case strictly to the same rule, but with a measure of consideration of the circumstances as well.