As someone who was sometimes using http as a back end transport for "edi" data (hey at the time it was usually ftp in that industry so no worse, but at least http got around nat problems than even pasv didn't), one time in the mid 00's I was in a coffee shop and just speechless flabbergasted outraged to discover the contents of a random web page I happened to know the contents of get some extra html and js injected into it from the isp (the isp not the coffee shop).

"WHO THE F gave them the right to modify the data in my tcp session!!!!".

Spying on it I assumed but modifying one byte of it? A naively written edi that did not expect that would be completely destroyed.

Probably shouldn't have been so stupid for 15 years already by that point. There is no such thing as the right, there is only the ability.

If someone has the ability to do something, they will. Reputation, right & wrong, none of that actually exists or matters.