For your first point, Aaron was not an MIT student or MIT faculty so whatever traditions MIT might have regarding their lax security, they didn't apply to
him.
Either way MIT made it actively clear to Aaron that his presence was unwelcome on their subnet. Keep in mind that your logic would excuse essentially any amount of computer crimes and actual vandalism if applied in general to anyone who cared to go to MIT. Note further that MIT 'hacks' are also famous for having the hackers treat the campus with great care to include not interfering with the rest of the students' study and cleaning up after themselves when they were done. And student 'hacks' certainly didn't last over a period of weeks and months.
As for your second point, MIT was the ISP (at least to the point of their network peers and upstreams) and since MIT is not the government the Fourth Amendment never applied between MIT <-> Aaron. Aaron's Fourth Amendment rights (which range Aaron <-> government) could never be violated by MIT unless MIT were working directly at the behest of the government, which is not something that happened here.
Rather MIT voluntarily cooperated with the prosecution after completing their own investigation (which is always the right of the victim of a crime). But ISPs don't get a separate legal immunity; if you are an ISP and act like an ISP (including following the law as an ISP) then you would have the same legal rights as any other "ISP".