Doesn't matter what the law says. If anything from any source is using my computer for any purpose which was hidden, disguised, or obfuscated from me, then it is an illegitimate use. Full disclosure, with explicit permission, or it's illegitimate.
That would make the Chrome browser illegitimate. Most people are not aware that it is spyware and it is not advertised as spyware, it just mentions it deep in an EULA (much like the application in this stories does about being bitcoin miners).
The problem is that a lot of people rely on and trust applications that classically would fall into the category of malware. Google even went as far as inventing a new category called badware, which was the same as malware except it didn't include spyware intended for advertisement.
If we accept that people are okay with using some types of malware (like Google Chome), then we need to consider our definitions much more deeply, because suddenly software that has unintended and potentially unwanted side-effects are considered legitimate.