You find "interesting" that someone just wants to report a security vulnerability without having to accept any conditions first?

Funny, I find it interesting that they want to pay a bugbounty even though nobody asked for it. But I guess paying hush money is just cheaper than having to seriously fix the issue.

I don't get the impression that the researchers were simply being lazy or attention-seeking.

They objected to having to sign an NDA, when there was no clear incentive to legally bind themselves in that manner.

This is a case where an email from mod zero to security@crowdstrike.com should have been enough to get the SOC to read and route the vuln to the product team and get a fix implemented.

NDA? HackerOne? Personal Information with Identity and Credit History Verification, Cookies and Disclosure Agreements, and 3rd party terms? Why is it at all "interesting" that a security researcher is not interested in giving all of up in order to tell CrowdStrike that their core product is broken in a way that is completely inimical to its mission purpose?

"Hey neighbour, you left your front-door open".

"Can you notify my lawyer by FAX, please? And can you get the document notarized first? Kthxbai".

It's interesting that they don't want to sign an NDA when there's absolutely nothing in it for them. Utterly astonishing. I'm hopping mad.

There's nothing at all weird about refusing to work through HackerOne. If you're not violating contracts (or the law) to conduct the research in the first place, you're not required to work through a bounty program at all; you can just disclose directly. Part of the point of a bounty program is to limit and control how disclosure happens; if your priority is the disclosure and not the cash reward, you won't want anything to do with H1.