Is someone saying tools shouldn’t be made? It’s good for engineers to think about how tools they make could be abused to mitigate damage.

In a case like this, the developer could have added some periodic notification to the device or require the device user to rotate a code or reauth with the service periodically to limit abuse.

Can you think of a modification like that you could implement on a baseball bat? Of course not. Is merely a straw man.