Malware is legal. You can study and research and even build malware without doing anything illegal.

What one usually gets in trouble for is causing destruction.

Regarding this case; wherever they ran in to problems, they probably should thank him for exposing that serious flaw in their release process.