When the Internet was indeed an open system with no legal framework whatsoever, this kind of survey could have been done (and celebrated!) without qualms. Specially since the researcher went to great lengths to prevent a rather benign virus from wreaking havoc on the routers while going on with its business.
Nowadays, this commercialized Internet, no longer a research vehicle, can't be used for it.
It is my strong feeling that many of the issues nowadays with the Internet would go away if the commercial part were a separate network from the Internet proper, with strong accountability and such, leaving the real Internet for the researchers and other stakeholders.
Illegal? yes. Just like flame and family. Just like civil disobedience. At the end, his work its the alarm shouting at our ears. There is no doubt, this breach has been abuse already, now we know. What you do with the info makes you ethical or not.
Ethical ? Well , what if someone else hijacks that botnet and wrecks havoc ? The goal may be pious but at the end of the day its intentions and methods are equally questionable.
With greater power comes greater responsibility.
If I did not lock my front door, just closed the door and went to the store. You came to drop of a flyer and tryed the door nob. Found the door unlock, would it be OK for you to use my bathroom to poop?
Ethical & illegally? Is the key words, never the same thing.