Click-baity title. The teen participated in a bug bounty and found some (know) vulnerabilities.
A whole thank you?
Well I did get to meet with the Secretary of Defense and get his personal challenge coin! And they did pay out bounties, I just wasn't the first to report the ones I sent in (despite sending most of them in on the first day).