No, I think notifying the police, who then notify the IRB is how normal people would deal with this. I don't expect the normal person knows about the IRB (I'm not surprised it exists, but I was unaware of it).

In a similar vein, if you notified your local police about a kidnapping they would notify the FBI, because kidnapping is the FBI's jurisdiction.

By "deal with this" I meant "deal with the fact that researchers have giant blind spots about the ethical impacts of their research."

I don't expect Joe Random to know to contact these guys' IRB, when they likely don't have one at all.

Ah, fair enough. I interpreted it as you saying people should have contacted the IRB, not the police, regarding this breach of ethics in research.