That's like saying if a website allowed SQL injection because they made a mistake in their code, you're complying with their contract by waltzing on over to the browser and dropping all their tables. Just because something is allowed via code doesn't make that the intent. Use common sense.