The story says that the password reset link was received, which proves the vulnerability without actually denying service, causing loss, etc. As an analogy, the attacker found a key to a door but did not proceed to open the door.

It doesn't say the password reset link was used to change the password, which would deprive the account owner access and grant unauthorized access which of course would be illegal.

You can try, but they will not do anything unless I do actual harm.

https://www.justice.gov/archives/opa/pr/department-justice-a...

If you do not want your gmail password reset, I recommend hardware 2FA.