He asked to accept "a patch" not "the patch". You left out the next sentence: "I was also open to working with him, addressing his feedback and sending subsequent versions of patches."
It should also be noted that by sending to security@, you trigger a machine optimized for getting fix merged fast to protect the user base - not one optimized for teaching new contributors.
This is the crux of the issue, and that generated a mismatch of expectations vs reality. If it went through LKML I'm pretty sure someone would have guided him to have a patch accepted and fully authored by OP.
As an external observer, however, I empathize and sympathize with OP.