I have been on both side of such submissions and sometimes people go outside scope, knowingly or unkowningly, try to show max impact in safe manner and bounties can be debated but a sincere thank you doesn't cost anything ig?
The way it was handled, in my 10 years of bug bounty exp, I had only seen it twice.