Yes he certainly is; he also reported it afterwards via HackerOne to get that $5k bounty. Two birds one stone.

If Musk is right, it's not weaseling out of contract.