Dunno how the hell one would not expect this to be be highly illegal. The guy literally wrote a software tool that covertly sends images from an unsuspecting device's camera to his personal servers, and installed+activated it on target machines belonging to the US's 3rd largest company by market cap in 2010 (now 1st largest). I get that in the pre-Snowden world, it felt like you were building a cutesy proof-of-concep…
since he had legal access to the computer, I don't think what he did is legally want different than running OBS on your own computer.
Apple made store computers available for demo, installing spyware on them clearly violates the level and kind of authorisation apple was providing. THe law makes these distinctions.
But likewise, so does anyone with half a brain. You cannot come into my house an d install a keylogger on my PC, even if I make it available to you to play around with for other reasons.