Kids used to call the act of editing Facebook posts via the element inspector and taking a screenshot "hacking". Considering the triviality of most web3 exploits, I think the descriptor still applies.

I'd say it falls under exploiting/bug bounty hunting so yeah it counts as hacking.

If that endpoint was made public by mistake, anyone using it might be held responsible.