I remember trying to recruit javascript programmers from the local maker/artist community, offering an internship that paid, I forget exactly, but something around $35/hour, which I thought was reasonable for an entry-level programmer. I got no responses, and later learned that my call was widely talked about as a scam, since everyone knew internships were unpaid or at best carried an honorarium.
It's difficult and time-consuming to on-board and train a programmer / developer / software engineer, but every programmer needs to start somewhere. I consider myself lucky in that I worked my way through college as a web developer for companies in Silicon Valley. If I didn't have my social network of other local engineering students, I would probably have started my career around $70k-$80k. I suspect that programmers in extremely rural parts of the US (like Alabama, West Virginia, Wyoming) would be lucky to find $70k/year.
It sounds like he only found XSS, which isn't exactly worthy of a job offer anyway.
1) XSS is game over for sites with authentication. What kind of vulnerabilities do you think are more important than XSS?
2) XSS is a result. There are a lot of complicated XSS bugs.
I would've loved an internship as a new high school grad... most people don't get a tech internship till 2 or 3 years into college.