An argument could be made it wasn't so much the discovery of the bug but rather the manner of reporting it that was a ToS violation.