Definitely. If it’s not prohibited, that does not mean it is allowed. If the repos had licenses, he must have knew what he was downloading. If the repos had no licenses, one has to assume no attribution - proprietary.

It would be reasonable if he downloaded one repo and notified the server maintainers that something is off. But he downloaded 580 repos and posted the files to mega and others. That’s criminal.