> they would've got a bug bounty from it!

Why do you think that, rather than get sued? I am curious

Microsoft have a bug bounty program which is credible and well run.

Suing people who responsibly disclose security issues to you is a disastrous thing to do. Word spreads instantly and now you won't get any responsibly disclosed bug reports in the future.

Microsoft are way too smart to make that mistake.