They can convict them for these crimes, but if they didn't manage to catch them before they return home, then they are unlikely to ever be extradited. This can also have diplomatic consequences, affecting the attitude for future treaty negotiations.
But in general, practical international law doesn't prohibit anything that the major countries want to do - the sovereign countries have voluntarily ceded some rights in treaties e.g. for borders and trade disputes, but they definitely retain their sovereign right to (for example) consider the government of another country as illegitimate and irrelevant, revoke their peace/border treaties (if any) and send in a million armed men to do things that violate local law.
UK law is binding to USA agencies only to the extent to which (a) USA agencies choose to follow it (by order of their own government and their own laws) and/or (b) UK is practically able and willing to enforce it.
And even in that case it's kind of common, well accepted practice to use embassies for spying on the host country. There are boundaries on what's acceptable (violations of which will have a diplomatic response or expelling all the involved and perhaps some random personnel), but nobody's really shocked if they happen to find that half of embassy stuff are there mostly for espionage tasks.
"International law" is not really equivalent in practice to ordinary law (which generally has the state monopoly on violence backing and enforcing it), it's more like countries have voluntarily agreed that it seems best that they should follow a particular set of practices. But they aren't required to - the main driver is that if you violate some norms, then others are likely to violate these norms against you. A treaty doesn't stop a country from doing something, a treaty is an indication that the involved countries believe that it's in their best interest if they all avoid doing that... but they'll be able to withdraw from that treaty (either legally, or in practice by simply doing the 'prohibited' thing) whenever they think it's best.
And vice versa! There are a lot of great Cold War stories about the bugging of embassies.
The surveillance in the embassy is in clear contravention of the Vienna Convention that the UK ratified on one proviso: that the surveillance wasn't sanctioned by the Ecuadoreans. If they did sanction it, it's not clear what, if any, law was broken.
The article states that there's evidence that the US also had laser surveillance outside the embassy. This would definitely be in direct contravention of the Convention regardless of whether the UK sanctioned it or not. I would say though that this appears completely at odds with the whole of the rest of the article: why bother when you're recording everything from the inside?
Their mandate is based on US law not whichever country they operate in, if they are caught they will be charged with espionage.
There is no such thing as a legal CIA operation, it might get permission from the host nation to operate but it doesn't make it a legal act in the nation in question.
If MI6/5 whoever gives the CIA permission to rendition or even assassinate a target from the UK that doesn't mean it's legal according to UK law.
Intelligence agencies operate in grey areas where there is an agreement in place as long as no one gets caught and most things are either kept so secret that no one would ever get to them or there is simply no paper trail at all.
The UK knows very well who is that CIA station chief in London despite them being there under false pretences which is a violation of UK laws, same goes for most of the CIA / any other TLA agency staff operating in a diplomatic mission under cover.
They all get some US State Department BS title and assignment and diplomatic papers but in reality they aren't diplomats and any competent nation knows all if not the majority of the TLA staff stationed in the US missions operating within it's borders.
This was almost certainly done by American embassy staff under cover. It’s thus a state, not criminal, issue. If Britain wanted to eject American diplomats for spying, it could do that, but...why?
Which laws in foreign countries do you expect them to be respectful of? And why? The organisation will have a high concentration of people who simply don't care what is written in the official law books and are only interested in what is physically enforced.
Surely some laws in the UK were broken? Or was all this sanctioned by the UK government? Or does the fact that it's an embassy mean that Ecuadorian law is applicable? How does this all work?