My 2 cents:
As Picard pointed out, Hugh was not a Borg anymore. He used personal pronouns. He refused an order from Locutus, which should have been impossible.
While it might be permissible to infect a Borg drone with a virus that would hopefully kill the collective(or most of it, anyway), doing so to some random stranger is totally out.
There was an episode of Voyager where some people had genetically engineered a child as a weapon against the Borg, with the plan being that the Borg would assimilate him and the disease he carried would attack the collective, and the reaction of the Starfleet folks was not "Cool! Wish we'd thought of that," it was horror, and "How could you do that to a child?"
Note that it was important that the child not know he was a weapon, since when he got assimilated the collective would learn everything he knew.
Hugh was an individual, and no longer a Borg. It would be horribly wrong to use him against the Borg against his will or without his permission, and if he knows what you are planning it won't work.
If Admiral Nacheyev was so sure that Picard's plan was the right thing to do, why not develop the virus and infect some random Vulcan you kidnapped, then dump him somewhere the Borg are sure to find him. Because that would be wrong
Admiral Nacheyev believes Picard should have gone ahead because she does not believe that Hugh was no longer a Borg.
For that reason, I do not believe Picard was wrong. Hugh was no longer a Borg drone, he was an individual, he use personal pronouns, he recognized Picard as Locutus and still refused an order from him. Hugh was not a Borg.