“JavaScript in websites can connect to this server and execute arbitrary commands on the target system.”
VS Code’s WSL server listened on every network interface. A web page could talk to it and run commands on the developer’s machine. It fell outside Microsoft’s bounty scope. The researcher spent $5 on a server for the proof of concept and got nothing back. That is the “negative profit” in the title.