That's pretty commonplace to clean up worms and the like. Once security professionals decompile the code enough to figure out where the control mechanism is and how it works, they will take control of it and use its own methods to get rid of it.

It's sort of the same logic given why we shouldn't require backdoors in general in devices: if the good guy can use it, so can the bad guy. Just, in this case it's being done in reverse.