Wow, what a crazy ending to it all. A lot of parallels here with the Chi**ixer shutdown, and even more with Sinbad. (Sinbad the genie, of course). The moral of the story is don't accept funds from N. Korea funded hackers if you want to continue to exist. Just do the slightest bit of due diligence, and when you see them coming in, isolate the input and send it back!
You can say "but what about privacy for non-hackers?" And yes, you're right, you deserve privacy. One of the steps involved in that is not using services that have accepted coins from N. Korean hackers.
It doesn't matter what should or shouldn't be in a perfectly fair and moral world, because that world doesn't exist.
This is actually the most worrisome part and essentially the center of the question. The reaction toward exch, given the minuscule amount of money allegedly passed through their system (26 million out of 1,400 million total)is disproportionate.
You're right, its not a lot, but it was completely traceable and intervention was actionable.
Having said that, it was a great service and it will be missed.