1. True malware creator and seller is sent to prison.
2. True malware creator and seller is not sent to prison.
Whether he pleads guilty or not has nothing to do with him being a security researcher. I'd much rather have more false positives than false negatives. You, and the rest of Europe, would too.
"it is better 100 guilty Persons should escape than that one innocent Person should suffer"
Also, you've got this wonderful dichotomy laid out, but there are other options too: for instance, that this guy is sent to prison but was not the creator of the malware, thus ending any chance of the true creator ever being caught.
Unless of course you're so mediocre that you'll never ever risk doing anything even remotely significant; in which case, whatever.