I agree with you, that the expectation is reasonable, however in the real world this is not always the case. I totally agree that the systems should be tested for this, and if not they shouldn't be in a live environment.

However I draw the line when an unauthorized actor accesses a live system to prove a point, rather than going through proper procedures with absolutely no knowledge of the potential outcomes of his or her actions. This isn't white hat by any stretch of the imagination, and is incredibly reckless.