I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.
Exposing software like that to the internet is of course a completely insane step.
Yes, Collins Aerospace is subsidiary of RTX, which is the distributor for a relational database for plane ticket credentials.