If you did SQL injection to "; drop table" on someone else's server, that would be a crime.

I don't see why prompt injection to delete files on someone else's machine would be any different.