It's complicated to just do something you were not supposed to and then go with: "look I know I had to do that but instead I did that so please give me [amount you never aggreed to pay]".

What he could have done on the other hand is: inform the client of the attack and propose him to get rid of it for a certain fee...