Sounds like they have perfectly valid concerns, actually.
When it comes to protecting restricted (and potentially rather damaging information) -- which also happens to be the University's property, anyway -- it's generally prudent to suppress the source, and ask questions later. Taken out of context, even a single vindictive or poorly composed review can be fatal to an instructor's career. Failing to take action to suppress their unauthorized distribution can also invite nasty lawsuits.
So this doesn't seem to be about "the man" stepping in and quashing student creativity and initiative (as much as some may prefer that narrative). If anything it seems that Yale did the right thing, in this case.