You are congratulating them on adding malware and then removing it.

Actions have consequences and this is a natural consequence, not a punishment. Trust was broken and users are not bound to prove the dev was in bad faith. The dev broke the trust and they can try and prove adding malware was done in good-faith if they wish. If the dev didn't care or _understand_ the severity of this change, then I have no problem if the project dies, gets forked, or whatever.