There's a difference between target shooting and threatening someone with a gun, just like there's a difference between pentesting an OWASP training VM and actively deploying ransomeware at a hospital.