Agreed that anyone who knew about the flaw should be as suspect as the employee in question. But what was this guy doing pentesting a competitor instead of performing his job duties - that’s grounds for being fired right there. Even with an “ok” outcome he’d have arguably caused harm to his employer.