Performing penetration tests without the permission of the site owner is unacceptable behavior. Such users should be banned.
The ability to limit pure functionality by adding the ability to lie or refuse to answer is undesirable.