You are correct...
"The Attacker" violated contract law as the courts interpret it...
And would be convicted of a hack because "code vulnerability doesn't equal consent".

As this lawyer explains:

http://www.coindesk.com/sue-dao-hacker/

The letter itself is a rehash of a Bloomberg View article:

http://www.bloomberg.com/view/articles/2016-06-17/blockchain-company-s-smart-contracts-were-dumb

If "The Attacker" was actually a Pro...
He would negotiate/compromise ETH miners by paying fees to launder the loot.

Just like Bitcoin miners launder illicit BTC for large fees on a regular basis:

http://hackingdistributed.com/2016/04/29/bitcoins-137k-jackpot/