Is there any action that Kaspersky or the general public should take to mitigate this risk? Is the suggestion that we shouldn’t work to eliminate malware in case it serves some higher purpose.

Will there be a new US law requiring checking with a secret government agency before publishing and patching exploits? Will it matter to non-US firms?

Maybe this secretly currently happens. No way to confirm, currently, and not productive to speculate.

What does "put lives in danger" really mean? It seems to be a deliberate blurring of the lines of culpability.

Most things "put lives in danger," in some sense (a just war, the invention of the automobile, rock climbing). Obviously the benchmark for what is acceptable must be much stricter than "put lives in danger," particularly when it's the lives militants.

Not really, it could be a fact based on knowledge. Although I’d agree it would be disingenuous to say it was intentional.

As Slingshot is a US-originated APT deployed against ISIS in Syria and Iraq, and the US is in conflict with the Russian state in Syria, it's a newsworthy question as to what aspect of Kaspersky's job is most relevant here.

We are not talking about some recombinant script kiddie malware: Slingshot is attributable, Stuxnet was attributable, the DNC penetration was attributable.

Nation-states with mature cyberwarfare capabilities, and their appendages such as Kaspersky, are routinely capable of identifying the authors of novel malware.

Indeed. Often a primary goal of operations such as that is to conceal and make attribution as difficult as possible.