Their service is their software. They have control over it. If they wish to impose technical limitations to how it may be accessed and by whom, that is entirely their prerogative. Nothing in the law can tell a company or a user otherwise, short of subpoenas for customer data or some such like that.
I think the larger legal issues come from the fact that circumventing these technical limitations can lead to to degradation of value and security for a company's customers due to derivative products created via this unauthorized client -- much like what has happened with SnapChat and third-party services retaining snaps. If systematic unauthorized access to a system could serve to diminish the value and trustworthiness of a company and its brand, you're damn right they will legally pursue those enabling it.