> My argument rests on the assumption that the dev was acting in good faith.

There is no way this was a good faith move, you don't expose your users to liability like this without informing them clearly and making it opt-in.