This isn't like bypassing the electrical grid by running your own line from somebody else's service.
This is like saying it's theft of service to read a chapter in the bookstore. If you hang out there all day, you might get kicked out, but that's not a crime.
The courts might agree with you, but only because "computers are hard".
There's a world of difference between tunneling over DNS and compromising servers. Or at least, there should be.
DNS tunnelling is not fast or convenient. Places deploying captive portals have probably looked at the risk to their business from it and have decided not to worry about it.
I can't believe that using a slow DNS connection, intentionally made public, to tunnel traffic would be considered theft or criminal.
How many free samples do I have to eat before I'm a theif? I don't believe I'm a thief until the offer for free samples is rescinded.
It’s like having a “free” street light and, instead of just enjoying the light, you pull its cables and plug your AC in.
The free service is just for the light.
Remember as abstract as the law can be, the legal system is not going to be amused by contrivances like "they were offering DNS service free and clear, so tunneling youtube over DNS is fine"
The legal system is going to understand that you were trying to circumvent paying for services and treat it appropriately.