I’m trying to think of a banking analogy. Maybe their website has a page that says “enter your checking account number to get $1,000”, but the web service had the authorization code commented out. If someone discovers that and tells their friends, have they stolen from the bank?
Note that I’m thinking of “theft” and “stealing” from a legal point of view. The moral angle may be very different.
However, if the bank had spent large amounts of time absolutely promising irreversible transactions, and publicly opened itself to attackers, then - no, that's just an intended operation of the system.
Which country's laws apply? What if one country considers the Ethereum contract binding, but the other doesn't?
It feels like having your cake and eating it too. I met lots of crypto bros, they all talk about how they use it so they can be immune to government censorship/intervention etc. They gloat about using crypto to avoid taxes and laws.
Relying on the same institutions that you are trying to get away from to overcome flaws in your framework seems entirely hypocritical to me.
And in your musings about which countries’ laws—therein also do you see the perennial mutterings of discontent at international policy, and globalisation shambling towards collapse. It may be averted. It may not.
This may not be the way things unfold, but it’s legally completely plausible.