I too would normally agree if the software wasn't actually malicious this time. It is one thing to create an infinite loop in a package that can simply be terminated, but a whole other can of worms to actually start removing users files. I generally agree with what you are saying that open source developers don't owe anyone anything, but there is a line, otherwise think about the precedent it sets when open source dies out because businesses and government stop using open source because of hostile takeovers by other nations who then use popular open source projects to spread malware. People cheering this would be devastated if this happened to them, but by cheering that is what they are advocating for.

Nothing is black and white, I think there should be some flexibility because afterall it is open source, however intentionally deleting user files or installing spyware is where I draw the line. If you want to break your own software, then fine, but don't go breaking other peoples software intentionally and deleting files when that is not what your software was designed to do and you've gave no warning or indication to other users that you plan to change it.