Quite unethical I'd say...
If this man was a properly trained IT Pro with an ethical backbone, then he should have fought the company from within. If you want a payback, wipe out a server or 2 and let them swim for 2 days trying to recover than put at risk so many others of your colleagues.
Morrisons should be perhaps partially liable but I can't see for what. This guy was IT and probably would have had extra access right to a lot of things to allow him to do his job anyway and they place a certain level of trust in him being a Pro.