Comment by jstanley

Telling Google about exploits in Google services in exchange for money is not illegal.

Telling them about exploits in other services in exchange for money might be, depending on context.

Your parent was talking about the former case.