He published a document[1] on their website with the letter head of the FCC, signed as the FCC. He was trying to impersonate the FCC. There were plenty of other things he could have posted to show off the vulnerability, without the worry of legal trouble.
Was he? This was obviously satirical. Impersonation involves a genuine attempt at deception, not merely having a few trappings of something official. Otherwise, what's the difference between this and somebody dressing-up as a cop for Halloween?
It isn't similar to dressing up a cop. It would be similar to dressing up as one, going to the police station, and telling people that they were a cop. Then trying to explain that it was only a joke and they didn't think people would believe them.
[1]: https://ecfsapi.fcc.gov/file/DOC-578d579d1f000000-A.pdf