Is there an Internet-of-Things vigilante out there?

>ARM architectures make up the bulk of infected devices, with MIPS and SH4 making up the majority of the remaining

this suggests it is NOT attacking routers (majority are mips), but chinese garbage networked cameras and such

>Resetting an infected device will remove the Wifatch malware Best. Malware. Ever.

As long as it's not on the chips I guess you're right.

Question I got afterwards was: Apart from disabling telnet, what kind of long-term modifications are made to the system?

I don't mind a nice vigilante "malware" that disables out-of-date daemons, but I mind if suddenly it added an opening for something else.