I can give benefit of the doubt that making a proposal to monetize user data is a poorly-considered, bottom-scraping effort to find a replacement funding source for the on call work. Most of us would not consider it, but I think it should be ok to occasionally pitch some bad ideas, all else being equal and lacking full context.
But messing with the credentials crosses an ethical line that isn't excused no matter how much you disagree with the other party's actions.
I can only assume it is silly revenge seeking behavior. Look at how symmetrical it is:
1. RC takes over GitHub Repository and locks everyone out
2. Arko takes over RubyGems server and locks everyone out.
He was an authorized actor right up until they tried to remove him, but they forgot to revoke his access credentials. I wonder if legally-speaking he was even considered unauthorized.
EDIT: Missed their email notification revoking his production access. Yeah looks like they could have a legal basis.
But messing with the credentials crosses an ethical line that isn't excused no matter how much you disagree with the other party's actions.