Meta paid the security researcher a bug bounty award of $27,200 for reporting the vulnerability, which is now fixed.

Check your 2FA implementations