The user discovered a bug, where anyone could apply games to their account, without buying or paying. He ended up notifying Steam (after he applied games to his account).

To them, like all bug hunt payments, the cost of what they gave him in the end ($4K) was nothing compared to the damage of that being shared - they get everlasting good press over it; good will, and they close the bug. So the $4,000 is alongside keeping the games he’d applied to his account.

Sorry, I could have worded that better! It’s on me for poor phrasing. English is not my native language, sometimes I can explain poorly.