Yes, the college student is the real dick here...

As others have mentioned, the security issue the student highlighted was a known issue.

I think going through official channels is the right thing to do for mission critical zero day type of vulnerabilities.

Bringing increased attention to a known, unfixed, issue, doesn't seem like a jerk move to me.