The law takes intent into play - a case of note was https://www.nytimes.com/2021/02/16/business/citibank-revlon-... - the ruling basically said "normally, this would be a reversible mistake, but the particulars indicate it wouldn't be".

The fact that the "owners" of the code fixed the code before it was exploited would come down heavily on the "illegal/fraud" side of things if it were litigated. If, however, they knew about it, and there were cases of it being done, and explicitly did nothing it possibly could be argued to be intentional.