To be blunt, that guy sounds like a dick.

This should have been a great learning opportunity, instead he took it as a personal attack.

I'm doubting his claim of 10 years experience. Someone with that much experience writing any sort of web code should know what a cross-site scripting vulnerability is, what can be done with it, and how to make sure it doesn't happen.

I've never used Fiverr before, but does it allow you to rate them? I'd drop a 1-star and comment that he reacted aggressively when you told him about a security vulnerability found in his code.