Every working system vulnerability is explicitly allowed by the code, or else it wouldn't work.

Do you mean that the OS provides for this possibility in a technical sense?

Or do you mean that the OS explicitly gave them permission to do this exact thing (and that permission was from the user?).

That something is technical possible isn't what makes something not a violation of the computer fraud and abuse act. Similarly, leaving my front door unlocked doesn't mean you aren't trespassing.