[charcircuit]

>sell access to the user's internal residential network

That is not what the SDK was doing. The actual code in the SDK protects against this (simplified to take less space):

    if (addr.isSiteLocalAddress() || addr.isLoopbackAddress()) {
        LogUtils.e("PopaTunnelAsyncThread", "Hacking? The Host Resolved Ip is " + addr + " on tunnel id:" + tunnelId);
        throw new IllegalArgumentException("Hacking? The tunnel host resolved ip is internal");
    }

Local and loopback addresses like 10.0.0.0, 172.16.0.0, 192.168.0.0, and 127.0.0.0 do not work. It will not connect to people's private file servers on their network.

[throwaway7356]

It'll still connect to IPv6 addresses and bypass any firewalls.

Also users might become part (victim?) of a police investigation because of illegal actions that seem to originate from their local residential connection.

So still good to take down such backdoors. Would be nice to go after the botnet operators as well...

[charcircuit]

Instead require app developers to explicitly call out this monetization method. This is neither designed to be a backdoor, nor a botnet. These are harmful classifications which can encourage people to try and target them like malware, when they are essential tools for privacy, bypassing geoblocking, and being able to collect public information from sites. The average person is not going to be involved with a police investigation. That has a tiny probability of happen and trying to blow it up to such proportions is dangerous to the existing of this important tool.

[inigyou]

Any webpage you visit can trigger an illegal action on your internet connection with a simple image tag, for example <img src="https://www.google.com/search?q=I+just+killed+my+wife.+How+s...">. It doesn't seem to be a real concern.