As a security researcher and someone who regularly participates in bug bounties, thank you. You didn't have to do what you did, but you did it anyway, just to be nice; that should be applauded, not criticized.

Remember everyone: if there's no bounty program in place, reporting bugs means that your expected value for those bugs is $0. If you get more than that, that's awesome, but don't expect it, or act like it's deserved; it's not. Enjoy your Yahoo swag and go on with life.