I mean, the existences of such bugs aren't valid grounds to exploit said bugs. Attackers do so anyway, whether because of some different ground that's actually valid (like being authorized to conduct a penetration test) or because they don't care about whether they have any such ground.