[TheRealSteel]

False dichotomy, they aren't threatening to exploit it, they simply won't give details of the exploit if they aren't paid.

[LukasReschke]

I'd advise anyone against trying that for a system not owned by them. (e.g., someone's else website)

As soon as you do that, you venture into dangerous territory. Companies are required to investigate claims of breaches seriously. And as soon as something like this is escalated, it may be out of the Information Security team's hands to decide the next steps.