I don't know that this is entirely fair. While a lot rides on a judge's opinion, in the end, the judges are only supposed to interpret the law and precedents from higher courts, not make things up as they go along. If there had been no precedent (ie. the Clapper decision), he may have felt more free to define a better test for "imminent threat".
You've forgotten that this is the USA, where the highest law of the land is the Bill of Rights.
The Anti-Federalists opposed the original Constitution on many grounds, including a) there was no Bill of Rights, and b) any Bill of Rights would be incomplete.
During the ratification process, promises were made that this issue would be dealt with. James Madison wrote a Bill of Rights, and cleverly made it open-ended, by providing for unspecified rights retained by the people (9th Amendment) and reserved to the people (10th Amendment), allowing the future assertion of rights as needed.
Thus, interpreting the law, in this country, is supposed to mean the judges consider not just precedents by their peers, but also any rights the people might want to assert under the 9th or 10th Amendments. An oath to uphold the Bill of Rights requires this of judges (as it does of all legal professionals, in any aspect of the practice of law).
In practice, the US legal profession seems to find it convenient to ignore this aspect of the Bill of Rights whenever they think they can get away with it. Perhaps this is because one of the rights the people might want to retain to them is the right to ethical practice of law, a right that would necessarily force many changes to how law is practiced at present. Then there's the right to ethical government
In this particular case, consider the following:
1. A claim was made by the lawyers for the defense of no injury, and thus, no standing.
2. For an identity theft victim to be forced to deal with credit card companies and online vendors as a result of this information breach takes time, and thus robs that person of an irreplaceable portion of their life, which is finite.
3. We consider kidnapping a crime in part because the same kind of theft (of a portion of a person's finite life) happens during kidnappings. Hence, an injury or damage has in fact occurred as a result of the information breach.
4. Legal professionals often work as intermediaries between private citizens and organizations or bureaucracies. People often hire them not because they have to, but rather because they don't want to deal with the hassle and potential loss of time associated with various situations.
5. A claim that "no damage" has been suffered can be expected to increase the demand for the services of legal professionals, as a class in society, in future situations involving identity theft (where they can be expected to function both as intermediaries, and in otherwise providing advice and assistance). Further, protecting the hiring of legal professionals in situations where people don't strictly need them is of interest to the profession.
6. The alternative, of course, would be to expect businesses to provide a reasonable level of security over the private information (something that would certainly be required under any 9th Amendment right to privacy -- nothing in the 9th Amendment limits its application to just government). Capitalism on the large scale necessarily requires some government regulation or other limitation on the conduct of business (quite of lot of Adam Smith's writing discusses this), and in the absence of competent direct regulation by government, rights arising under the 9th Amendment can be made to serve.
Note the ethical conflict of interest this situation poses for legal professionals, as a class in society. On the one hand, they increase their future business, and their job security, on the other hand they create a situation where the public might become more aware of the 9th Amendment and its implications (a very scary thing for the profession).