How does anything you said fail to apply to using a software vulnerability to create a request to which the server responds with "yes sir, here is the private i

How does anything you said fail to apply to using a software vulnerability to create a request to which the server responds with "yes sir, here is the private information you requested"? Should we just say it's a technical problem that the operator should have solved themselves and make that legal too? How about physical locks while we're at it? I'm not a fan of this ruling but your argument proves too much.