Dunno how the hell one would not expect this to be be highly illegal. The guy literally wrote a software tool that covertly sends images from an unsuspecting device's camera to his personal servers, and installed+activated it on target machines belonging to the US's 3rd largest company by market cap in 2010 (now 1st largest). I get that in the pre-Snowden world, it felt like you were building a cutesy proof-of-concep…
This is yet another occurrence of the draconian CFAA being used to persecute individuals, often with severe life-destroying penalties, for what should be considered, at most, misdemeanor trespass - a modern day witch hunt. And since the CFAA hinges on this nebulous concept of "authorization", it's straightforwardly nullified by a contract of adhesion, so it does nothing to protect individuals from transgressions by companies.