I think if you run AGPL code on a public server and someone breaks into it, you also don't owe them the source code because unauthorized access isn't legitimate use.