That also sounds like the client came with list of additional requirements.

The ethical part you mentioned is still true.