Most "seasonal" vaccinations are as mathematically sound as playing the lottery.
A lottery where you have a 60% chance of winning.
They had many choices, simple two choices: Report bug and get $12.50, amazing yahoo was not giving them tree fidy. They could have gone onto some darknets and sold the report for $100,000+. The choice was theirs to make.
Which is exactly why Yahoo should have paid them more. Make the choice less obvious and save themselves a lot of grief further down the line.
"Phased-plasma pulse rifle in 40-watt range".
It's great to be smart 'cause then you know stuff.