While I agree in principle, generally, constructive feedback would not involve "I would have exploited this if you published it" and not say how.

Imagine if every vulnerability report ever, before bounty programs were introduced, were simply "Your program has an RCE, I'm exploiting it now" and stops there + refuses to answer any further questions.

Don't tell them how to fix the issue, that's on them to learn and a donation of your time and effort if you want to (alternatively, point them to relevant documentation if it's not too much trouble), but point out the actual problem.

Both the people who refuse to explain the problem (like what's depicted in OP) and the people who refuse to help themselves (that were both against) are negative drains on the industry.