But parent was talking about hosting servers for a client. If the client executed that command, I don't see how the provider could be responsible.
The client could be. But they'd need to extradite him, from Russia, which might not be so easy, these days.