The tech big mounted the safety flaw, netting a safety researcher $10,000 for privately disclosing the bug.