They sold access to send or send/receive messages for use cases where customers would legitimately consent. E.G. a wireless Bluetooth accessory that wants to access and reply to SMS message content on Apple devices that Apple won't grant access to.

Still. It meant a very powerful API key had to be protected and never abused.

I can only imagine others obtain God SMS access like this with less than ethical intentions.