I want to know why law enforcement allows a private organization to seize private property based on some algorithm.

I have heard bad things about shadowserver in the past. Now I wonder how much other collateral damage they have done over the years.

Domain names are not property, and this is not under the pervue of law enforcement. The country registrar (NIXI) is working together with someone to prevent abuse of their systems. When you purchase a DNS entry, you agree to this sort of thing as part of the ToS.

The domain got transfered to The Verden Public Prosecutor's Office.

Evidently law enforcement was involved in some capacity.

Right; this is essentially the same as a mail server operator relying on a DNSBL.

Exactly

This is what I was wondering as well, it seemed bizarre to me and I expected there to be much more outrage here about it. I wonder if it's a bit like local parking regulations, which tend to be written in ways that allow towing companies to abuse you as much as possible.

I'd rather like to know, what gives shadowserver the authority to initiate such domain takedowns/sinkholing in an act that's pretty much vigilantism?

The decision is made by the registrar, so that's who should be answering these questions.

As far as I can tell the chain of events was:

1. shadowserver had an oopsie (i.e. added a false entry to their list)

2. that list was taken by the prosecutor's office to without further checks and by the authority of the prosecutor's office (i.e. state attorneys) of Niedersachsen in Germany and contacted the registrar in India.

3. The registrar transferred the domain

Between each of these steps, there are so many things that went wrong, on so many levels.

Between 1 and 2: Why is the word of some rando org taken as gospel? Without being independently investigated by the office, which sole raison d'être is (independent) investigation of the claims brought to it.

Between 2 and 3: A German prosecutor's office has no authority outside the EU; and even if it did, it could not tell anyone anything to take enforcing actions without a proper court order, even if it's an international request.

Also in the grand scheme of things, considering this was all done to "take down a botnet", this is a path to hell paved with good intentions. How about creating incentive that software and hardware manufacturers get their shit together and secure their shit?

Shadowserver runs the sinkhole, its up to the registrar/dns company (in this case namecheap) to point it at the sinkhole. The Feds provide a list of "identified" domains to all the major providers for the avalanche take down. Since this is an on going thing, someone at namecheap blindly ran the list without any verification.