You are right. Anyone can perform the same attack as long as he possess of in-depth knowledge of how the block producing works. Don't get us wrong, we have huge respect towards witnesses who put in tremendous amount of time and effort in securing the network(you can track our witness-voting history), else we would not have been in the first place.
Let’s just focus on the fact and eliminate all the “what-ifs”. He was cool that he did published the exploitation in detail and returned all the fund. He was not cool on how he performed the “white-hat” trick which only be halted by third party’s alarm to the house, which is very likely to drain the bank if nobody was aware what he was doing. He was rewarded with the former cool part.
If you think what he did was a fair play, we don’t think we should further discuss on this. Appreciate the feedback!