Researcher claims Microsoft is trying to circumvent security bounty payments