What I’m saying is something about the story doesn’t add up.

Either Microsoft classified a major issue as a minor one so they didn’t have to payout the bug bounty (quite possible), or the attack didn’t achieve what the researchers thought it did and Microsoft classified it according to it’s actual results.