[tikl1]

It's complicated to just do something you were not supposed to and then go with: "look I know I had to do that but instead I did that so please give me [amount you never aggreed to pay]".

What he could have done on the other hand is: inform the client of the attack and propose him to get rid of it for a certain fee...

[ploxiln]

He did cancel the job, at the end, but it sounded like he wanted to investigate the hack for fun, when he came across it.

Not a good general/continuing policy, but maybe worth doing the first time, if you're interested.