Would it be illegal to innoculate IoT devices by forking Mirai and then changing each vulnerable device's default password to a random choice of high entropy?
IANAL, but I'm pretty sure the answer to that is "yes". It would set a terrible precedent by authorising vigilantism, and I'm not sure how you would define "vulnerable" under the law.
Doesn't this brick the device from the user's perspective?
In many cases, sure, but there is usually an easy way to reset such a device back to its factory defaults.