I reckon the more likely truth is that the Path folk genuinely saw nothing wrong with what they were doing. There are a group of people (call them the Facebook crowd, if you want) who think that excessive privacy is unnecessary, extending that thought to sharing people's address books.
No one ever says "I'll be evil". Instead, they come up with ways to justify the evil that they do.
The only reason for giving someone who "meant well" a pass is if it's likely that the bad outcome was fairly unexpected. If, as is usually the case, the bad outcome was likely, they should be held accountable for intending it, just as we do with drunk drivers. No, "meaning well" isn't an excuse for ignoring reality.
Remember, most of the world's horrors are caused by folks who claim that they're trying to do good.
A child would know that this was wrong. It's that simple.