well, silver lining is that they now have provable damages from this dev's actions in that it played a role in sinking their business.

The dev will just pull up the Jira ticket that says "Add malware to app" in court. That's why they were advised not to sue.

Hopefully he made a screenshot.

I'm advising people for a long time now to make screenshots of emails etc. - at least have everything in writing, don't act on phone calls if you feel things are "in a grayzone" (happens often in startups).

Its pretty clear that a dev with a second degree in law still wouldn't have been able to determine whether companies that shared most of the same infrastructure and listed corporate officers were 3rd parties in the context of software, without grilling someone who may or may not be a Trustcor executive, may or may not be the past founder and may or may not be dead, where such a death neither implies nor dismisses the possibility that they are still running the company.