Does the law actually and specifically forbid an active self-defence? After all, if someone is coming at you with a knife, even a UK court will very likely not convict you of kicking the bastard in the balls. (a recent clarification of the has confirmed this)
Pre-emptively taking out an infected computer which might attack you is currently illegal, but I don't think anything has been tested in court where someone has attacked back against a currently attacking endpoint. If this flaw allows for a more active defence by crashing or otherwise disabling attacking endpoints, it sounds like a reasonable use of force in self-defence. I could imagine it might get messy though since there are likely to be many international jurisdictions involved.