Actual prosecutions of malware creators are exceedingly rare to almost none existent. As such I believe there are extreme pressure on law enforcement to "Make an example" of some malware creator, or anyone they can even remotely connect to the creation of malware.

This pressure I believe will lead them to over reach on CFAA like they have in the past in other "hacking" cases

https://www.wired.com/2015/10/cfaa-computer-fraud-abuse-act-...

So while I can not point to an example right now, that is simply because there is a general lack of case law in the field to begin with, nor does that support a position that the FBI is correct in this case, or would never go after a innocent security research, their history defies that completely.