Capturing a user's credentials and logging in to a system they don't manage is nowhere near your analogy. Unless AA is operating a public API, this is an unauth

Capturing a user's credentials and logging in to a system they don't manage is nowhere near your analogy. Unless AA is operating a public API, this is an unauthorized use of their service, which they absolutely have the right to shut down and protect themselves against. If someone takes the key to my house and goes inside without my permission, it's still breaking and entering.