You see this work as merely exposing cyberintrusions. However, for the powers in question, this constitutes harming or disabling strategic intelligence capabilities. At this point shit gets real.
First of all it would be legal for Citizen Lab to do the exact same thing exposing abuses of the Canadian government. As a Canadian I would expect them to if they discovered the Canadian government doing the exact same thing. This is something protected by internationally and nationally (Canada) recognized rights of free speech, not a crime.
Second acts of wars are between countries, the concept doesn't even make sense here. Citizen lab is not a government.
Sure it can always be that their vetting-process is shit -- but I doubt that a real intelligence agency would create such an easily falsifiable legend. From what I have read about the topic there are whole departments dedicated only to the task of building robust identities, companies and so on [these companies wouldn't only have existed on paper].
Retributions are also not very likely (at least in Canada). Anything that would attract the ire of the local or federal police and further endangers other operations in the country in question are very unlikely for such an insignificant target. Even at the height of the cold war keeping agents undercover was considered more important than conducting operations.
Taking steps to intimidate a citizen because your spy screwed up is an act of war, but not by the citizen.