It's complicated to just do something you were not supposed to and then go with: "look I know I had to do that but instead I did that so please give me [amount you never aggreed to pay]".

What he could have done on the other hand is: inform the client of the attack and propose him to get rid of it for a certain fee...

He did cancel the job, at the end, but it sounded like he wanted to investigate the hack for fun, when he came across it.

Not a good general/continuing policy, but maybe worth doing the first time, if you're interested.

He didn't configure exim4, for which he was hired. He wasn't hired to investigate the compromise, which he did do.

Still, he provided a service that was important for the customer. And, the customer wanted him to configure exim4 because a lot of the emails sent were marked as spam. The compromise was most likely the biggest reason for that.

Sometimes it's like that. He could try and get the customer to pay him for this but he might lose on the long term if they've been a recurring customer for a long time.

Let's be honest.

The moment he discovered an attacker he should have been on the phone with the client explaining the situation and asking how to proceed. If the client wanted him to shut down and clean up the hack, he should be charging for that. If not, he should have done nothing.

Transparency resolves most problems.