Well run bug bounty programs have strict guidelines on what is and is not out of scope, and changes like this would certainly be out of scope (in fact, generall

Well run bug bounty programs have strict guidelines on what is and is not out of scope, and changes like this would certainly be out of scope (in fact, generally social engineering as part of the exploit chain is itself wholly out of scope).