You could argue all hacking is just doing something that is (accidentally) allowed by the target system.
There may be obvious practical difficulties in identifying the counterparty and enforcing a judgement in them, but if that becomes possible (and if $10m is at stake, perhaps it might become possible, bounties, etc) then the argument that "code is the only representation, and this is what the code said, so this was lawful" is not valid, as it contradicts both contract law and fraud statutes.
But the actual contract terms between the parties and facts like is this contract valid at all, who owns what and who owes what to whom are ultimately determined by contract law, not by the smart contract, like it or not. The smart contract may determine possession of certain things, and in many cases it would be uncontested and there it has a purpose of just doing the contract settlement automatically, but as soon as there's a dispute, then the legal ownership and any claims would be settled according to contract law, not according to what the code says.