It's not a complicated distinction:

If you think they intentionally had their model hack third-party systems, you could do a criminal investigation.

I do not think that this is reasonable to believe given that clearly the VMs were not intended to have internet access and that committing such crimes wasn't in anyone's interest.