The problem is that you're encouraging people to keep stuff like this to themselves until they can use it to perform an exploit that they'd get paid for, which is the opposite of what Microsoft wants - they'd much rather you report it now so that if an exploit does get found that requires root they would potentially be protected.

The simple question for Microsoft to answer is - does it matter to them if attackers have root access on the container? If the answer is yes then the bug bounty for root access should at least pay something to encourage reporting. If the answer is no then this shouldn't have been marked as a vulnerability because root access is not considered a security issue.

Presumably someone with mal-intent would sit on the root vulnerability waiting for a container breakout bug to come around.

Almost certainly yes, since at that point all you're looking for is a Linux kernel LPE.

> they would've got a bug bounty from it!

Why do you think that, rather than get sued? I am curious