Yeah, but there’s a difference between white-hat hacking (where you find an exploit, test it once to confirm its validity, and report it without abusing it) and actually modifying a bunch of records (the equivalent of what this would be). White-hatting tries to be minimally-destructive while proving the vulnerability.