I'll absolutely agree that vigilantism is a terrible idea.
However, we are currently in the wild west until a formal offensive government "police force" gets established. Your examples of Microsoft getting "court orders" to execute those offensive attacks are nice, but keep in mind that no court actually has the power to authorize use of force, of any kind, except as prescribed by law.
These regional attempts at creating an offensive authorization scheme lack the sort of coordination we want to see from someone like the FBI/CIA/NSA/etc. who can coordinate information and ensure that regional efforts aren't affecting larger investigative efforts.
Under the law, it is important to remember that you always have a right to protect yourself, however, it is unclear to what extent that right extends to the digital realm. In the physical realm, for instance, in defense of property you are not allowed to use deadly or overwhelming force. "Non-deadly force can be used to protect property that is in the defendant’s lawful possession if the force that the defendant uses reasonably appears to be necessary to prevent or terminate an unlawful intrusion onto, or interference with, that property. See People v. Payne, 8 Cal. 341 (1857)."
I would expect that you would need to be prepared to defend your (your company's) actions as "reasonably necessary." However, you need to do a risk analysis with your legal team before any such actions as there is an element of uncertainty when applying new technologies anyway and then you always have your baseline uncertainty about what might be considered "reasonable" at trial.
Should we have a "code of ethics" established for such actions? Absolutely. Until we can agree, as a profession, there's nothing we can point to as a reasonable standard in court. The primary thing judges like to see in a "reasonability test" is what a plurality of industry professionals agree is reasonable.
