Absolutely. I think this is more of a failure of the IEEE Security and Privacy program committee (PC) than that of the university. The chairs should have desk rejected it on ethical grounds. Failing that, at least one of the reviewers should have noticed this was fishy and raised the alarm. And failing that, someone in the full PC meeting should have been like "whoa, hol up." (though this last failure could be partially explained with PC meetings now happening online instead of in person, so less engagement)