I think this is fine. The crime is invasion of privacy, not murder, but the consequences of their crime can, if convicted, be taken into account in sentencing.
That the maximum sentence is 5 years does not mean (not by a long shot) that that is what they will receive, but when you commit a crime, you take the victim as they come. Some crimes against unstable or frail victims will have consequences beyond chat the criminal would have expected, and when you engage in criminal conduct you generally take on those risks to some degree.
The risk of a frail victim either falls on the victim's shoulders entirely, or partly on the criminal's as well. If I punch a man for no reason, and due to his congenital heart defect, he dies, he's not at fault at all while I am. Wile the real burden falls on my victim and his family, it's only fair that my punishment fit the harm I caused to some degree.
One can argue that the punishment should only fit the harm I reasonably expected to cause, and that I should not be held to account for improbably events that could not reasonably be anticipated...but that encourages people to commit crimes if they deem doing so would be "efficient" (if the benefits of the crime outweigh the reasonably foreseeable harms). While there is an "efficient breach" mentality in contract law, I don't see any appeal in extending it to criminal law.
It is true that the the two charged will live with this for the rest of their lives, but so will the families and other friends of the victim. Criminals may do some soul searching after any crime, and usually we offset their mental anguish against their punishment.
One could also argue in this case that invasion of privacy is, in effect, not a "real" crime, or at least a sufficiently abstruse crime that the criminals involved in it might not realize that there is any significant question of the ethics of their actions. The lack of a clear ethical proscription might then lead to a different standard of punishment. That is fair enough, if moot, but the place to make that argument would seem to be the legislature who passes the law, and not the prosecutors or courts who enforce it.
Personally I think invasion of privacy at least in the present case is a clear ethical violation and so I am not inclined to let the perpetrators off the hook. (Some slight caveat, I am largely taking the allegations in these articles to be true. Even doing that, it seems as if Molly Wei was less involved in the invasion than was Mr. Ravi, I am not sure whether anything she did warrants punishment. I think more evidence of her involvement would be needed to make her conviction fair.)