Comment by EnFinlay

The researcher can still disclose it, they just aren't going to get permission to disclose it on the Hackerone program. Most things out of scope don't get publicly disclosed as far as I know.

Doesn't seem too unreasonable.