Maybe I’ve still got the old PS3/PSP-exploit mentality, but reporting an arbitrary code execution vuln to the OEM is kind of sad… that deliberately closes a door for people to use their devices as they see fit.
Of course, the “don’t update after this firmware version” bit would always be the case (since any widely-distributed such vuln will be patched eventually), but deliberately moving the timeline to the left is sad.
So many things are done with the end of making some profit, either directly monetary (bounties) or career.
People like these hope to get the recognition by the big companies to get the fat paychecks they dream to also pull in.
On the other hand, many others hack stuff and at most tell their closest friends.
Of course, it's availability bias: if this person wasn't disclosing it somehow, you wouldn't know. And even just a random article online is basically a disclosure minus the other benefits, so people contact the OEM while they are at it.