I am not a lawyer, obviously!
The hacking was a pretty clear example of the CFAA but it comes down to the mens rea of the operators.
My understanding of the mens rea ladder:
Purposeful: the outcome was the goal.
Knowledgeable: you knew the outcome was very likely to occur and did it anyway.
Reckless: you knew there was a risk but disregarded it.
Negligent: any reasonable person would have been aware of the risk but you did it anyway.
Seems like the bottom two runs would be relevant here.
If a small Chinese lab had done this they would have certainly been prosecuted, and it would likely have established precedent for how to handle this.
In this case, it seems unlikely for it to be prosecuted.