Hmmmm............

since he communicated what he found (source code, which is copyright protected) to third parties
Well, over here it is protected in so far as you cannot use it in your own product or sell it to others..............after all, who would want to buy or use stuff with known exploits in it?

There might be a breach of contract case, as most EULAs prohibit reverse engineering?