Yeah we have xbox devkits and that sounds pretty much right - as long as your "exploit" doesn't break retail mode, MS will almost certainly reply "good for you, have fun". Their developer mode is pretty open.
Good one. He even released his unattended script privilege escalation code:
> This service is only registered and executed when an authorized Xbox One is running under Developer Mode and will not execute in a retail environment