If they don't give root, researcher may have incentive to keep vuln secret for root access. Looks reasonable.