Victim blaming is not cool. These types of over-the-top legal threats in response to good-faith engagement are extremely common and it's why bug bounties have safe harbor protections.

Nope. Universities are wild and their technology is weak. It’s always been this way.