From the article: "None of the changes, including falsified information about food allergens that could have been harmful to visitors, ever appeared before the public, according to court records."
It was caught through review, and the defense claimed that he knew that would be the case and therefore he put no one at risk. I'd argue that systems can fail, review can fail, and if that happened people could have died. Giving him credit for that seems absurd, and his claim that he just wanted attention is equally absurd. If you just want attention the profanity and price changes would achieve that.
Regardless he wasn't convicted of any crime related to potential harm to customers, he was convicted for hacking and identity theft.
And probably only because Disney was his target and could pay a technical team unlimited money to investigate and spoon-feed the FBI and prosecutor everything they needed. A smaller chain or independent bar/restaurant would not have even gotten the time of day with a complaint about someone changing prices on a menu. And they would have been the ones in court defending any claims of injury due to undisclosed allergens, with only a vague claim of "our menu must have been hacked."