What are their damages? He's not required to disclose their security vulnerabilities to them. It's his work not theirs.
I think lovasoa is pointing out what could happen in real-life, not 'what should happen morally/ethically/etc'.
if he was smart, then he said nothing that sounds like blackmail. but you could say, for example, that I have to settle the expense of reproducing it and writing it down properly or something similar.
sue him for what? Discovering an exploit without disclosing the details?
It depends on the country, but in France for instance, there is a maximum sentence of one year in prison and a 15000€ fine just for "fraudulently accessing a data processing system", or trying to do so even if you don't succeed.
And they'll prove that without knowing what the exploit is?