“I was not expecting to cause this big of a code change in Android with this bug.”
Swap in a SIM, enter the PUK, and the Pixel unlocked itself. Physical access was the only requirement. Google marked the report a duplicate, which took the payout from $100,000 to zero, and sat on the fix. It only paid $70,000 and moved the patch up a month after he set a disclosure deadline. The bounty program works best when researchers threaten to go public.