Arun Sureshkumar netted himself a $16,000 bug bounty for a zero-day vulnerability in Facebook Business Manager.