It’s worse. They are saying that the EU copyright law, as written, only allows decompiling/reverse engineering to “fix bugs”. A bug fix would involve a software patch of some sorts. But the security researchers did not have time to write a patch yet, what they did is tell the customer “Yep, it’s fucked. Your vendor put in a killswitch to make the trains brick themselves.” So that does tell them where the problem is, but it is not a bona fide bug fix from the Bugfix region of France, and therefore illegal.