NAL but I'd be worried about treading into CFAA territory with things like this. In the US, the law allows draconian penalties if you find yourself on the wrong side.

Something like yt-dlp is just downloading public data, which I can see being defensible as automating the use of a service.

But this commandeers remote machine resources to do your compute in ways clearly not intended by the provider. I don't know how ethical it is, but I definitely wouldn't want to argue this isn't "hacking" (the bad kind) in criminal court.

Not to mention, did this "hack" ever really work? When the original post went viral showing the Chipotle chatbot reversing a linked list, I (among others who posted their results online) immediately tried it and didn't get the same results, so I always assumed it was just a faked screenshot.

And if you think CFAA is bad, then the states have even harsher versions too. Illinois' version specifically criminalizes any violation of a ToS.

Yeah, this is not slap on the wrist stuff. I think the creator expects nothing more than a C&D letter, but they could face prison time if a zealous federal prosecutor wants to make an example of them.