Should we just legalize the FAANGs to engage in cyber warfare/espionage against each other? Seems like then they would have to reach a minimum of best security practice instead of relying on obscurity.
They all have bug bounty programs. If you avoid causing actual damage or downloading actual customer data, and disclose what you find, it’s already legal.