The salient part seems to be that the researcher reported the first vulnerability through HackerOne and was (reportedly) told by Steam it wouldn’t be fixed. He then published it after being instructed that was against the rules and was banned
I wanted to note that the researcher was not banned at HackerOne, he was only banned from reporting bugs to Valve. This is written in the article about a second vulnerability [1]