I can definitely think of at least one way that hiring the guy who hacked into your company's computers, planted keyloggers, and stole the source code of your project could hurt. I thought of another while I was typing that sentence.

Maybe the kid who did it wasn't actually sorry; maybe he was hoping to get more access so he could steal more stuff. That's a way it could hurt.

Maybe bringing the kid who stole your team's work and demoralized everybody isn't going to do great things for the company morale; that's another way it could hurt.

Giving people second chances is great and all, but it seems silly to say "[it] wouldn't have hurt"; it could have very easily gone wrong.