This isn't malicious compliance. It's over-the-top compliance. He has no requirement to comply with their random demands. He does anyway.