For people who believe the marketing: why would a legitimate sysadmin tool include a cryptocurrency miner and a feature to turn off the webcam indicator light?

This was used to exploit people, plain and simple. While I don't think blanket arresting people who downloaded it is reasonable (someone may have fallen for the marketing and used it for legit reasons), shutting down the C&C servers to disable it from working and aiding in exploitation & blackmail is a net good.