Surely intent is important though? I mean, if I send a GET request to a URL on the internet it can be assumed that by making the URL public you consent to that

Surely intent is important though? I mean, if I send a GET request to a URL on the internet it can be assumed that by making the URL public you consent to that. However if that GET request is including fragments of SQL then and you manage to dump contents of the database using that then that would be a more clear cut case of abuse even though you are just sending GETs to a public URL.