Not sure what I think of this. There are a lot of "what if's" and grey areas. On the one hand you could say that online avatars are not people, or not physically connected to people, so cannot commit crimes, and if a person felt uncomfortable then they could take their VR headset off and report the user.
On the other hand, it is a virtual violation. It could also imply actual intent from the Vrapist so a reporting mechanism should be in place, much like that of someone boasting online that they can make a bomb to blow people up. It has to be treated as a real threat.
This is at least not complying with online terms of use and is essentially bullinging. At worst it could be seen as threatening someone's safety. How is the user to know whether or not the VRapist intends to find out where they live and do it in real life?