How is this any different than exploiting a web application via something like SQL injection? After all, their implementation legally allows you to supply inputs containing those characters and their system responds by doing whatever with the database. Is that fundamentally different than supplying "expected" input and getting expected outputs?

"Your program just computes a different function than you expected and I supplied legal inputs" can be used as a defense of literally all software exploitation.