It was just a matter of time before this happened and it brings up some interesting legal liability questions.
The article doesn't appear to discuss what criteria the spyware program uses to identify files targeted for corruption. Possibly only the name. Or maybe by name plus some other criteria such as a hash. Let's assume it's merely using filenames:
Now, let's construct a scenario: Let's say I've named one of my critical business files, say a spreadsheet or database, such that it becomes a target for intentional corruption. Let's ignore arguments like "nobody in their right mind would name their files like that." When the spyware program intentionally corrupts that file, it would seem I have a clear legal case against the spyware company.