With the resources cPanel has at their disposal, if they wanted a to file lawsuit against this guy for disclosing security vulnerabilities, they could easily do it. I doubt they were trying to "lure" him in to file suit - what are they going to sue him for? What damages could they collect...