From their perspective it might feel a bit like a hostage situation: "I found a way into your house. How much you going to pay me tell you how?"

From your perspective I would imagine that exploring the vulnerability, packaging and capturing the steps-to-reproduce are all work. Work should be paid for.

In summary, I don't think they can make demands of your time and effort by requiring you to package and share. But don't let it sound like a you have anything they have a right to or that you're holding anything hostage.