Yes, Cox has that choice. But, what you're describing is the definition of extortion. The fact that it's easy for people to get away with it does not make it ethical.
The comment I responded to was this:
>it's only fair for them to financially award people that responsibly inform them of vulnerabilities instead of easily and anonymously selling those.
That comment includes the threat ("instead of easily and anonymously selling those").
So, yes. That is the definition of extortion.
The following two sentences read the same to me:
"To remove my incentive to harm you, you should pay me".
"To remove my incentive to share information with others who may harm you, you should pay me".
And, the threat is pretty clear IMO.
Ransomware victims have sometimes found it practical to pay the ransom. They're still victims of extortion.