I agree. I've also noticed that some developers seem to have a strong sense of "we should not do that" while others don't and I'm not sure why.

One recent example was impersonating/spoofing a manager's email to send phishing emails as part of a security compliance test. One developer saw no harm at all in doing so while another felt we should ask permission first.

It's a basic violation of trust to do this sort of thing and in the very least, permission should be obtained first. Otherwise, the violation of trust and repercussions may be severe.