To be fair, it looks like it was only patched in the last 24 hours so not totally unreasonable...yet.
"Hi, we have fixed the issue you reported to us. Thank you so much. We are willing to offer a reward of <x> dollars to you, because you have protected our customers. Please reach out with a payment address or any other questions you might have. Thanks again, Tim from <Large corporation>"
and... stop timer. 11:27:38
was that so hard?