I've also had some similarly bad experiences reporting vulnerabilities to managed HackerOne campaigns. I'm guessing the HackerOne staff is primarily trained to judge web vulnerability reports. Anything beyond that often triggers odd followup questions or even a rejection like in this case.