You seem to be insanely hellbent on implying the actually worst possible intent to the researcher who acted in the good faith and contacted the vendor aiming for the quickest and best fix.

It looks like you're weirdly trying to inflate a legitimate attempt to confirm if the severity of the exposure is as bad as suspected into a full blown nasty data thief.

This is why everyone is so puzzled. You're genuinely harassing op for doing a good thing and responsibly reporting the severe security problem.