You probably have a different definition of malicious than most of us.

What you're thinking is, "Did he do this to break things at McDonald's or actively hurt them in some way?"

But if he's hitting an internal API and creating a bunch of fake orders for the purpose of gathering data, that's malicious, whether or not it breaks anything on McDonald's side.