If Microsoft's entire child-security protections don't work; I'd say that's fairly major. What might have been a very compelling feature for parents has been shown to be ineffective (if your kids know about the vulnerability, which for young children is admittedly unlikely).

They paid him at all, which is good, but it also shows that there's no reason they couldn't have authorized a bigger payout. It's still, at most, $350. Why not free Xbox Gold for life instead of one year? There's no cost to Microsoft.

There's no obligation, it works as a deterrent for publishing the vulnerability to potentially bad people. Many tech companies now offer a reward for submitting vulnerabilities, it's more often than not cheaper than being exposed.

Except those games won't resell at that price. In the end it's less expensive for MS but I suppose it would satisfy a young gamer. As an adult I wouldn't like to be paid in games or in on-line subscriptions.