Once RCE is confirmed, any further access from there would break ToS. It's bullshit, and kind of a cop-out - but it's a trade-off that these companies have to make. Otherwise we could employ techniques like social engineering to gain internal access, then start pen-testing from within the network.