The need to break the law to stop a criminal is interesting. It seems like that is well established in physical confrontations. The police can shoot people threatening others, and you can kill someone in self defense.

Surely researchers fighting a botnet should be covered under the same logic. The patch they force on 3rd parties should remove windows or force the use of Firefox.