If you want to use this as a selling point when engaging his current customers, I see nothing wrong with that. If you offer greater security than he does, it's fine to point that out.
That's exactly it. There is no law being broken. The best way to capitalize off of this is to use the weakness of the competitor as a means to market yourself as a superior product. You can even use testimonials from the former customers who switched to you to further boost your own product. It doesn't sound like this competitor would be too hard to beat on merit rather than underhanded tactics.
You could also get your sales team to call your competitor's current customers and ask "How safe is your data with "X"? Are you looking for a super-secure alternative? Buy my product." Or something...
If you want to use this as a selling point when engaging his current customers, I see nothing wrong with that. If you offer greater security than he does, it's fine to point that out.