This is the best argument. If they send me an exploit it isn’t expected for me to run it blindly because of some unwritten contract, right? Once the payload is sent to me it is my right to execute it as I wish. That is the unwritten contract.