I agree we'll need to know how malicious is defined so it can be applied to this situation. He didn't get to choose the time and place it took place. He didn't go to the mall looking for trouble, it found him.
I'm also not fully sure how many shots were fired. The few articles I read before didn't mention it, but assuming it was 1 and done. It hit the intended target to neutralize the perceived threat, using a caliber that most likely wouldn't fully penetrate. I would say a he didn't act with neglect for other's lives that were not a part of the situation. If he wildly fired his gun and somehow managed to hit the guy, then yeah I could easily see how that could be malicious/neglectful.
Anything can be circumvented, VPNs, Tor, I2P, and some other more unknown apps like briar. The issue will become will using those services become illegal too, and the barrier of entry becoming too high for those outside of the technical world. Signal will definitely just pull support for the EU, so you'll have to trick it into thinking you're not in the EU. But now you're at risk of running a foul with the law.