"the applicants would not be 'controllers' of that data"
Really ? Well, let's see what the GDPR has to say about that :
For example, if Acme Co. sells widgets to consumers and uses Email Automation Co. to email consumers on their behalf and track their engagement activity, then with regard to such email activity data, Acme Co. is the data controller, and Email Automation Co. is the data processor.
So, in this case Virgin is the supposed data controller, and the IP trolls are supposed to be the data processors. Except that it is not Virgin that is asking them to do anything, they are demanding the data for their processing. The example is not applicable, the IP trolls would indeed be the data controllers.
The judge got it wrong, that's for sure.