Summarizing what I've seen here in analogy form:

  Researcher: "I found a way to unlock your door"

  Facebook: "Thanks, here's $2500. We've now fixed the problem."

  Researcher: "Oh, BTW when I unlocked your door I rifled through
    your stuff and found your passport, your banking details, and a
    lot of personal information. I've kept copies of these. I also
    found the keys to your car and looked inside, where I found a box
    in the trunk. That box contained sensitive documents including an
    employee badge / proximity card. I used this card to gain access
    to your workplace. In doing this, I also managed to get into the
    janitor's closet which had a set of keys. I used these keys to
    get access to the complete building and took a look at all the HR
    files and rifled through a bunch of corporate contracts."

  Facebook: <gobsmacked>

  Researcher: "Can I have my million bucks now?"

Where the researcher stepped over the line is using the door attack to escalate further attacks. It's little different than finding a way to reliably impersonate Mark Zuckerberg's credentials in such a way that others will 100% believe it. That finding is worthy of a reward. But then using that vulnerability to social engineer others to reveal passwords, using that as a launching point for mounting further attacks is going way too far.