Unfortunately, like many physical security analogies, there's no one correct way of translating the details from the software world to the real world. I think

Unfortunately, like many physical security analogies, there's no one correct way of translating the details from the software world to the real world. I think how close you think those two situations are depends on whether you consider the application to be an agent of the customer (like a personal shopper), or of the shop (like a salesman). Did: A - the programmer coerce the application (an agent of the shop) into accessing secret information (breaking into the shop warehouse), or B - the programmer ask the application (his own agent, a personal shopper) to go and look for interesting things in the database (shop's warehouse) for him, a privilege that the application (personal shopper) was afforded in advance by the shop? I personally think that A is a dangerous precedent to set for society. Treating any network-bound application as the agent of its creator would mean it was wrong to observe your computer (which you generally use for more than just accessing one online shop), and would therefore effectively kill FOSS.