I mean, there's probably more than enough intent here for prosecution. There's a fairly significant difference in selling a RAT that does remote administration, and selling a RAT that includes bulletpoint features to evade antivirus detection, persist through removals, and other features explicitly against the wishes of the device owner while the author actively and exclusively only advertises on script-kiddie forums and provides advice and encouragement of malicious infections.

I don't think I've ever seen people gone after for the former, even when it's been abused by miscreants.

At least in the US, people already "go after" security researchers all the time (at least the companies not smart enough to realise just how much a well meaning email can save them).