I don't see the problem with the tech itself. If you have a "BYOD's allowed" policy, that also usually states that "if you put your own device in, here are the rules". Rules may state installing the network owner's root CA and allowing for traffic to be inspected.
In most cases, this is intended to be benevolent - it's kind of hard to run threat detection algorithms on an encrypted connection. In business environments, DLP and similar can of course be used too.
Now, in here I think the key issue was that the users were not told about the practice, and were not asked to agree to these stipulations. And of course, the old adage about not attributing to malice what can be explained by incompetence also applies here - if the issue got "fixed" then it might have been simply just that, incompetence. Somebondy enabled the same SSL interception on the student network that they are using for faculty, or similar.