shodan[1] is a search engine that deals in hosts and ip addresses rather than web pages, and is a goldmine for finding everything from exposed ip webcams to jenkins instances.
Accessing computer systems owned by a US company based in the US might constitute a violation of US law, but the hacker is based in Switzerland - where US law does not apply.
As you can see in the linked Wikipedia article, accessing these systems is probably not illegal in Switzerland, thus, for all intents and purposes, no crime was committed.
https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...
In fact I don't think any countries will extradite you to North Korea. There's plenty (including many in the neighborhood of Switzerland) that extradite to the US for at least some crimes.
(I am open to missing something here)
Us law applies wherever they want. Very, very few governments will refuse a request....it's too expensive in the long run.