If we abandon the moral "should", then the right move is to shake down Google along the lines I already said.

Google should, as a rational actor, pay out better for legitimate vulnerabilities that pose actual risk to them to avoid such a situation.

My beef here is that morality and ethics are only assigned to the researchers.