[pricechild]

One of the issues is that it is HackerOne making the demand, not Valve.

I have been involved with other bounties on that site in that time, related to other companies & products.

I suspect if I had "broken their (Hackerone) policy" with this issue in that time, there would have been problems receiving a reward from the other bounty programs relating to different companies...

This isn't the only reason I haven't publicised the issue more widely, I've had other things on my plate, but it is a consideration.