You are talking about the greatest exposed hack of the computer supply chain so far by a big margin. Laws can be made retroactively for this type of thing. It has implications that are beyond the legal system, as the threat level is way beyond what is typically required as a sniff test for justifying military actions. This was not an RCE based on identifying negligent code; this was a carefully designed trap that could reverse the power dynamics during military conflict.
Ex post facto criminal liability is prohibited either constitutionally or by strong custom in most jurisdictions, and this is generally considered a fundamental part of having rule of law and due process. This is also spelled out in UDHR, ECHR, and several other similar documents.
Not sure it is worth spending any effort on this subject, however a ton of existing laws in almost any juristiction could be applied to this particular crime. I doubt the perpetrators would be caught, but I also doubt the punishment would be established via a legal system in a public setting anyways. Depending on what jurisdiction it is and who feels most compelled to punish them or not, it is possible they could be used as spies again for a different government. I wish I would be able to read the story behind the story eventually but I very much doubt it. The existence of a public key means there was in principle a way to verify the identity beyond doubt, though I don’t know how much longer this will be the case.
