Stories like this are wonderful evidence of the effectiveness of public disclosure of security vulnerabilities, and are always heartwarming to see. Remember, 90-day disclosure windows are just a courtesy.
But like all things, they can also be used to keep software insecure, hide issues, and instead buy off researchers.