Also not saying it's illegal.

The non-zero mean and relatively small standard deviation (0.4 sigma) make all the difference here.

I'd say the ethics and legality are entirely determined by how this distribution was determined and if it's consistent with promises to customers.