"Since they're implementing this in a stupid way, it's perfectly valid to exploit their method[...]"

Really?

If you went to buy something on Amazon, and found they had a "stupid" vulnerability you could exploit in order to get half off of your order—maybe some Javascript hack that made the part of their system that calculated the price you pay think you actually ordered a smaller version of the product—is that immoral?

Is leaving your house or car unlocked a sufficiently stupid vulnerability to become "perfectly valid to exploit"?