FB procured the exploit, LEO executed it. There are no legal implications, only moral ones, and I'd say the only debate there is over lack of disclosure _after_ use. That's really sketchy.

But developing it in the first place, handing it to those legally authorized to use it, and catching someone like this - I don't understand how anyone could be against that... again, as long as the exploit is burned afterwards.