>I think they should have gotten permission from IRB ahead of time, but this doesn't sound like they were researching human subjects?

I assure you that it falls under IRB's purview -- I came into the thread intending to make grandparent's comment. When using deception in a human subjects experiment, there is an additional level of rigor -- you usually need to debrief the participant about said deception, not wait for them to read about it in the press.

(And if a human is reviewing these patches, then yes, it is human subjects research.)