I will grant that he found a problem where DBI and CGI was used together carelessly.
I think I remember him saying that perl comes with DBI, even though it has never done so. Also CGI has recently been taken out of the core distribution. (Most people have been recommending to not use it since around the year 2000.)
a) limited in time, because you do research in your free time.
b) getting negative, or even worse, no or ignorant feedback by the other party.
c) getting tired, because you preach the same stuff over and over again.
I think is really hard to do responsible disclosure and maintain a calm attitude during the whole process. There is this awesome talk about responsible disclosure by David Kriesel who found bugs in Xerox's compression algorithms:
https://media.ccc.de/v/froscon2015-1524-lies_damned_lies_and...