The dev will just pull up the Jira ticket that says "Add malware to app" in court. That's why they were advised not to sue.
I'm advising people for a long time now to make screenshots of emails etc. - at least have everything in writing, don't act on phone calls if you feel things are "in a grayzone" (happens often in startups).