There is so much disdain for unethical, ivory tower thinking in universities, this is not helping.

But, allow me to pull a different thread. How liable is the professor, the IRB, and the university if there is any calamity caused by the known code?

What is the high level difference between their action, and spreading malware intentionally?