I'm not going to comment on the bug itself  as no PoC has been provided (I don't think it's ethical to post it publicly without the casino's consent, anyways).
However, I wanted to salute you for your honesty and reporting the bug instead of exploiting it and milking the casino's wallets dry!
I also wanted to share my opinion on your second question:
You can't hold them accountable especially if they don't have a bug bounty program. Even those who have it but don't want to pay you can claim it's a duplicate and reject your report.