This was more or less inevitable. I can't really condone janit0r's methodology, but at least he's doing _something_ to solve the problem. Hopefully this leads to security requirements legislation or IoT companies caring more or something.
I realize that the title is ripped straight from the article, but it still seems misleading, as the context surrounding the "2 million devices" number seems to imply that a majority of those devices were not bricked, but rather that the bricking was only done on devices that couldn't be taken off the menu through other means.
So, if he's serious about that number, he's caused at least $60 million in damages (given a conservative estimate of $30 per device). No matter what his intentions, he'd be facing serious charges if caught.