completely violating your users trust is an interesting way to react to a disclosure of a potential security vulnerability
I guess this makes sense. On the other hand such actions might have had legal implications before. I mean until the CEO actively allowed / awarded them.
You will still be in trouble if you deface some random Namecheap customers website to claim this bounty.