I don't have much sympathy for a huge corporation like McDonalds, but isn't this is kind of an asshole move by the developer?
Regardless, it annoys me when I see developers abuse semi-public APIs as it just ends up being a motivating factor to close things off more. There is most likely some developers working for McDonalds who have been scrambling as a response to what this guy is doing. It isn't nice to create unnecessary work for others just so you can have a little fun.
And it is typically during the cart-adding process that you find out if a product is actually available for purchase or not, as opposed to at checkout time.
I would assume that's what is happening here, which means it's not actually affecting any in-store operations, just (as the author says) probably messing with their analytics a bit.
Hopefully he's doing it in a way that lets the analysts easily mass-filter his activity (perhaps by IP, or by adding some filter for his very atypical "one McFlurry from each store" order configuration).
Seems reasonably harmless in my mind, if he's not making use of any non-public endpoints or keys.
EDIT: I'm not sure why, but moderators have detached this line of comments from where I was originally replying. I really don't think questioning the ethics of something like this is out of line on HN, but I can understand the phrase "kind of an asshole move" might have upset some people. Since this is the only comment I can still edit, I will just throw in the clarification of context that detaching this comment might have removed. The "asshole move" I was referring to is the practice of brute forcing this information through an internal McDonald's API by sending $18k worth of orders every minute.
He doesn't say how that works, but again if I had to guess I would bet it's checking the response to "add to cart" or something similar.
Given the cost of $1 for a cone, he's checking 18,752 locations per minute, or about 1.28x the number of branded restaurants in the US + Canada.