But perhaps his appraisal was near to some threshold and some events pushed him over the edge and he decided to force the XMR community to prove it is worthy or insolent. Just one possible theory for the chain of events.
Remember Risto issued the 4 - 8% proclamation of the likelihood of a BCX attack while the 72 hour deadline was ongoing. One could ponder if this might have caused BCX to not call off the threatened (unconfirmed) attack. There was some progress on trying to find any vulnerabilities, so perhaps one could ponder if he might have called off the threat citing progress and cooperation.
The reason for not just handing over the vulnerability and fix, may be to illustrate the competence and to teach the community.