So a chess player that exploits an opponent’s weakness is hacking?
A snake that finds an entrance to a gopher burrow is hacking?

“Finding vulnerabilities” is the kind of dangerously overbroad generalization that gave us the DMCA.