The only question I have is whether his employment contract forbade this activity. If it did - and it probably did, relating to a clause about disclosure of intellectual property and trade secrets - then he should be fired. Those clauses are in there for a reason - not the least of which being to protect those sensitive pieces of information from current and/or future competitors, as well as to protect the code itself from hidden back-door security holes, hidden superuser logins, etc. Whether or not he has a law degree - which he probably doesn't - the company did not hire him as a lawyer and certainly did not authorize him to execute contracts with third parties relating to their intellectual property and trade secrets. Nor did they authorize him to put those items at-risk.
Personally, I think the company should sue him for back pay to be held in escrow until such time as their own developers can review all of the code he submitted, both for security and for potential IP and trade secret leakage. Once and only when everything has been cleared and checks out ok, he can have back whatever money is leftover after paying for that investigative work.
The job of a software developer is more than just writing code to spec. If it isn't, then indeed the work can and should be outsourced to anyone by the R&D mgmt team. But if it is, then it isn't this guy's decision to make about what's ok and what's not.