The lessons i learned here are:
1) any RCE vulnerability of Instagram leads to unrestricted access to user data. Facebook knows it, does nothing about it.
2) facebook will not pay you your bug bounty reward, but will complain to your employer.