My understanding is ACF injected notices for their personal legal gains on everyone's dashboards.
I wouldn't be surprised if such thing is a breach.
This is cited in WPEngine's lawsuit. Like you said, I wouldn't be surprised if this behavior of matt's was a breach.