I mean it makes sense. If he can get account access or remote execution, that's a lot of money. Unless the hacker is already pretty well off and doesn't need it, it's probably not worth the publicity stunt.