Unlike Snowden's disclosures of mass surveillance, this is not whistleblowing. Mass surveillance, such as recording and correlating cell phone location data or searching all emails, is immoral and unconstitutional, and it's good that the extent of it was revealed. Doctored USB cables do not enable mass surveillance since they have to be physically delivered to specific subjects. Assuming they're delivered based on so…
It's not reasonable to "punish" an organization that went too far? If you don't do that then they don't have much incentive to stay within the lines.
You're not punishing the organization though, they'll exist regardless. You're punishing anyone who relies (knowingly or not) on the services provided by that organization.
Or put differently, would you force an electric company to shut down operations for 3 days if they were discovered to be overcharging their customers?