Eight years later, it's easy to read an article and empathize with him. But if someone sent me an email that said, "I kinda stole your multi-million dollar source code, but really do like you and want to be friends." I would not be very trusting.
I think it highly depends on the delivery. I've mentioned this in another comment lower in the thread. Basically, had he contacted Valve and informed them about security the flaws and then shared the source code with Valve to show/prove the potential danger (instead of the guy who leaked it,) I don't think it's totally unreasonable for Valve to hire him on to the security team after he truly demonstrates skill and passion for the company.
