If the result of this tweet is that one of my domains is altered, and that I lose income, users, or other useful metrics to measure the value of my site, this seems like a great piece of evidence to be litigious towards Namecheap
How is this different from any other bug bounty program as an incentive to compromise live functionality/user data always exists?
It’s the difference between stepping in a bear trap and poking a lion.
Well run bug bounty programs have strict guidelines on what is and is not out of scope, and changes like this would certainly be out of scope (in fact, generally social engineering as part of the exploit chain is itself wholly out of scope).
Bug bounty programs usually explicitly forbid accessing other people's data.