There are copyright exceptions for security researchers. Apple can block access to their network services, but I doubt they can do legal action, at least not based on copyright laws. Of course in this particular instance it sucks, but in general, such exceptions are very valuable as they allow researchers to find out about vulnerabilities and warn the public without being impeded by the manufacturer.