“[the security researchers] may be liable for fines, damages and each individual of the [security research] Group may be imprisoned… Criminal penalties under the CFAA can be up to 20 years depending on circumstances.”

“the Group’s actions are also a violation of Buzz’s Terms of Use and constitute a breach of contract, entitling Buzz to compensatory damages and damages for lost revenue.”

“the Group’s agreement to infiltrate Buzz’s network is also a separate offense of conspiracy, exposing the Group to even more significant criminal liability.”

Emphasis added. The language is quite a bit more forceful and threatening than you make it out to be. Given that they were issuing these threats as an ultimatum, a "keep quiet about this or else...", it was likely a violation of California State Bar's rules of professional conduct.

No, you are talking about criminal law. What OP is talking about is severability, which exists so that if a judge determines Clause X violates the law, they can still (attempt) to enforce the rest of the contract if X can be easily remedied. I.e. The contract says no lunch breaks but CalOSHA regulations say 30 minutes required, the contractor can't violate the contract in its' entirety, they just take the breaks and amend the contract if the employer pushes it.

I disagree with OP - a judge can always choose to invalidate a contract, regardless of severability. It is in there for the convenience of the parties, and I've not heard of it being used in bad faith.

you can read the language they do use here https://stanforddaily.com/2022/11/01/opinion-fizz-previously...

they threaten if they receive written confirmation that the researchers won't discuss the security issues they won't pursue charges.

The lawyers were very much not "for your information you could be liable for x if someone responded poorly", they were in fact responding poorly.

"That's not the language they used. They simply admired your place of business and reflected on what a shame it would be if a negative event happened to it. How would you keep people from saying that? It's basically a statement of fact..."