despite explicitly mentioning that one "should not expect any payment for non-security issues", perhaps there may be some exceptional wiggle room.
There could be some wiggle room, but the page also says something about not revealing the bug anywhere else besides to the email address provided
You must report the bug to the bugs email address listed on the contact page. You must not publish it elsewhere or share it with anyone else.
Revealing it or hinting at what the bug could be can also pass as publishing it elsewhere.