Iff they had foreknowledge that the changes were going to happen, which is unlikely. Id be surprised if Kite bought/acquihired/etc the product by disclosing a list of shady changes beforehand.

The minimap author, committing those changes after being hired by them, labelled them "Implement Kite Promotion".

The question remains, would he have accepted the purchase/job if he had known that Kite intended to do this? My point is that he probably didn't know until instructed to do so my his new bosses.

At which point he did it and is equally responsible as if he knew beforehand.

Beautiful use of "iff" in a sentence! ("iff" = "if and only if" for those wondering).

Contrarily, I would be surprised if the devs sold their code without asking, “why do you want it?”

Isn't that a bit too witch-huntery? It is Kite who is actively doing the shady stuff.

One of the owners was hired by Kite half a year ago.

This changes their power dynamic. One could argue they ought to find another job once the shady stuff started, but I still think you should focus on the actual instigators rather than the pawns.

In a security-sensitive corporate setting it is already harmful if anything gets uploaded to some cloud service - if this occurs, the damage already happens and anything that follows is "just" damage containment.

I believe about every company that develops software has some clauses about what software is allowed to be installed on the corporate computers and who has to initial any request to install a new program on the computer.