If PayPal says it is not a security issue, the researcher should just publish the details of how it's done.