“The legal threats are the reputation damage. Not the vulnerability itself—vulnerabilities happen to everyone.”
Bug bounty culture gives companies free security work. When they don’t like what gets found, they threaten the person who helped them. The legal response here is the entire point. The vulnerability exposed minors’ personal data and the organization’s answer was a lawyer letter.