Imagine a meeting where some bureaucrat went to their boss and said "hey this person did us a huge favor, can I get a €30 budget to specially order them a gimmick t-shirt" followed by some correspondence where the government obtained their address and shirt size, yet bizarrely not their name. I can't believe that happened.
You could look at it the opposite way around - someone's come up with a genius idea to do a bug bounty on a beer budget.
[0] https://english.ncsc.nl/latest/weblog/weblog/2022/i-am-on-th...
A team of government workers spending paid time deciding which security volunteer deserves the most nonfinancial recognition mildly irks me.
Also, it's unlikely that they didn't just ask for the author's size and address. The standard disclosure process involves a temporary non-disclosure and negotiating if/when publication of the issue will take place.
The author was pleased with the response, and the process has improved since this was published.