Microsoft chose to run a shoddy bounty program. The researcher tried to do the right thing.

Microsoft could have prevented this. They were warned. It's their own fault.

The exploit exists whether or not the researcher reports it. They didn't make the exploit.