Is this verified? Even if it's just the 'webserver' and not the whole software it's a pretty big event.

I'm behind on my twitter timeline...the answer is yes. nitter.vloup.ch/zackwhittaker/st… Many implications to this.

Reminds me of the legal and ethical questions raised by researchers who were able to infiltrate and/or take over botnets. Can they set the devices free? Or only allowed to observe? Is it ethical to do nothing and allow harm?

Yep. Did apple deem this as malware? Or is it because it was undocumented? Or maybe Zoom asked for Apple's help. Could be lots of things.