I can't tell if this is legit or not, due to the typos, writing style, etc. I name searched this person and found some tweets of them collecting two other bug bounties from Facebook.
https://twitter.com/yaalaab/status/1603827006243733520/photo...
https://twitter.com/yaalaab/status/1431371005654618117/photo...
https://twitter.com/yaalaab/status/1268659389625483265/photo...
He got $3000 for finding this bug, which seems unusual since it sounds like the most catastrophic thing possible. Facebook also paid him $15000 two years ago for another bug bounty, so I can't imagine how bad that one must have been. Glad to hear the rewards for white hat hacking are so lucrative. He'd probably be better off applying for a job at Facebook as one of their janitors, cleaning the toilets of clueless SWEs.