If Microsoft's entire child-security protections don't work; I'd say that's fairly major. What might have been a very compelling feature for parents has been shown to be ineffective (if your kids know about the vulnerability, which for young children is admittedly unlikely).

They paid him at all, which is good, but it also shows that there's no reason they couldn't have authorized a bigger payout. It's still, at most, $350. Why not free Xbox Gold for life instead of one year? There's no cost to Microsoft.