He didn't say he would distribute a fix, he said he would write a virus to spread the fix.

Imagine there's a locksmith in your town. All day long, he drives around breaking into people's houses without permission, going through their possessions to see if there are any burglars hiding in the house. Then he replaces any broken locks and leaves a pamphlet about home safety tips, and goes on to the next house. Would it be unethical for him to do that, even though he tacked a note on a public signboard mentioning that he was going to do this sort of thing? This is the situation we're discussing.