I wonder if he's actually qualified for any bug bounty given the public announcement, even with the dangerous parts blacked out.
Probably not; seems to me like a pretty dumb thing to do if he wanted any bounty. The domain is nearly as dangerous as the URL, since it leads attackers directly to the vulnerable server(s).
Terms of their bug bounty program just says "You may not publicly disclose the vulnerability prior to our resolution" ... https://hackerone.com/twitter