There's absolutely nothing wrong with saying "between X and Y" in my opinion. You just always make sure X is what you actually want, and Y is at least 30% higher. Give them the opportunity to grind you down, it'll make them happy; give you the ability to say "look, I've already let you take X% off what this should cost" which will come in invaluable later, because it's an instant ego-booster for the other guy. Always let the other guy think he's won, simple rule.
A key point here is that he didn't use a proxy and doesn't seem to hide his identity during the sniffing around, which means he's either:
a) stupid.
b) not intending to do anything malicious.
I think a. is unlikely, because he did actually manage to break in, although, the hole itself might've been trivial and therefore this might not count. I don't think so, though.
Which leaves b.
I think it's pretty obvious from both sides of the story that what Chris intended to do was (c) demonstrate the existence of a vulnerability in order to hard-sell his security consultancy.
Reading between the lines, it looks like his sales tactics were heavy on the FUD (he pointedly hasn't denied making any claims about Russian conspiracies), leaving Frind paranoid and angry. And probably also embarrassed if the security flaws were as basic as is being suggested.
