Yes, that might happen. Taking that position to its logical conclusion, nobody should be indicted for anything.
There are serious problems with the US justice system. As far as I can tell, there is nothing at face value that's unreasonable about this indictment.
1. True malware creator and seller is sent to prison.
2. True malware creator and seller is not sent to prison.
Whether he pleads guilty or not has nothing to do with him being a security researcher. I'd much rather have more false positives than false negatives. You, and the rest of Europe, would too.
"it is better 100 guilty Persons should escape than that one innocent Person should suffer"
Also, you've got this wonderful dichotomy laid out, but there are other options too: for instance, that this guy is sent to prison but was not the creator of the malware, thus ending any chance of the true creator ever being caught.
Unless of course you're so mediocre that you'll never ever risk doing anything even remotely significant; in which case, whatever.
Another is that he might plead guilty and we'll never know whether he was guilty or innocent (but threatened with consequences he didn't feel he could risk).