Oy.
Not that I am going to pretend that I know what the dollar value of Sclafani's time/effort should be, but I have a hard time believing that $20,000 is an insult. Just because he could get more money by exploiting the bug -- or showing others how to exploit it -- doesn't necessarily suggest to me that he should get paid more than he did.
In other words, if you can sell an item for $100k if you follow a set of laws (a government's, an organisation's, a community's, or your own), but you could sell the item without doing so for $500k, the item is still really only worth $100k (to you), but the (physical/societal/moral) danger involved in selling the item illegally that goes with it is not worth $400k to you.
Or, put another way, the item may be valued at $500k (to some potential buyer), but the legal buyer of the item is offering not to put you in danger in exchange for $400k.