Imagine the pressure on them. They had $200k of donations to show for and every privacy activist has been following them for months. I bet half those holes would've been patched if it weren't for all the pressure to release.
Little effort, high reward. Then he can grow into enjoying a huge engineering project. When I was 14, I scripted Java bots for Runescape and made phishing sites for it (poorly). I owe Runescape gold my programming skills. Lowly, but an awesome introduction into programming. Try to find something he could get cheap thrills from.
Twitter program, perhaps;)?
I can offer an anecdote here. Through some loopholes in homeschooling graduation requirements I got into my local community college at 16. Before long, I couldn't stand to be friends with most high schoolers. This whole high school mentality perpetuates itself (see: other countries).