The law doesn't make code which causes harm illegal, it makes code which does not operate in accordance with the user's intention illegal.

Think about that for a second. Think about every program ever written which did not operate in accordance with the user's intention. Literally every bug is punishable by three years in prison.

This is a classic example of legislators saying "We don't understand the problem, so lets just make everything illegal and rely on the police and prosecutors using their discretion to only put the real criminals in prison," followed by the police and prosecutors not using their discretion and putting a non-criminal in prison.