Which just demonstrates that these guys are actual bad actors, so blocking everyone at the university seems like a reasonable attempt at stopping them.

It's objectionable because of severe consequences beyond just annoying people. If there was a malicious purpose, not just research, you could bring criminal charges against them.

In typical grey hat research you get pre-approval from target company leadership (engineers don't know) to avoid charges once discovered.