MS is pretty bad about vulnerability bounties. I reported one about privilege escalation on WSL1 and received no response plus it was patched within the following months. Was a bit aggravated.