I’m not sure it is. If he doesn’t release anything but the patch he’s not redistributing any code or content that belongs to a third party. Similar to how emulators that don’t come with a BIOS are fine.
Its actionable on multiple grounds; circumvention of copy protection, decompilation of and modification of proprietary code, appropriation of IP name, etc. All the laws that fundamentally are only there to protect enterprise from large scale commercial exploitation/espionage still apply, its just that generally its not worth the hassle of litigating so they let its slide.
The only time this doesn't hold true is when the IP holder feels like the infringement is being rubbed in their faces, at which point they will feel compelled to act. Especially so if the product/IP is still a viable commercial prospect, because that gives grounds to assert fiscal harm.
Not arguing the morality of this at all, just the legal realities as I see them.
The problem for Lance is that he's gained a fair amount of attention (and rightly so) for his good works, and he's never hidden his methodologies. So legally, he wouldn't have leg to stand on, and all he'd achieve would be to put himself at loggerheads with Sony/FROM by making them look bad or weak comparatively.
In its way its like "don't ask, don't tell"... what's generally accepted and what's not depends on how much attention it gains.
The bottom line is that if this was a patch for a PC game, noone would give a shit. That its a mod for a console-only title that requires a cracked PS4 to apply makes it a much bigger target, because no doubt Sony would prefer as few people as possible to know that you can break the protection on their hardware and they sure as hell wouldn't want anything that encourages and/or promotes the practice getting highlighted. Not to mention the aforementioned "embarrassment" factor.