The problem is with the expression, the codification of the policy, as implemented in code; not the policy itself. It's the flawed implementation of the policy

The problem is with the expression, the codification of the policy, as implemented in code; not the policy itself. It's the flawed implementation of the policy that the attacker took advantage of. The attacker's justification is self-serving and ridiculous. Given any non-trivial software, especially in a new domain, there are likely to be bugs that can be exploited to undermine the system. And that's exactly what happened here.