Microsoft runs a bug bounty program. NightmareEclipse (that’s the researcher’s handle) allegedly participated and Microsoft did not honor their part of the bug bounty program terms.

This is a completely different situation - a company evaluates the security of a prospective vendor prior to entering a business agreement.