White-hat hackers go to prison for running a scanner on a website and reporting the found vulnerabilities to the website owner without exploiting them. I don't see why this should be any different.

It's different since there was no single physical person who executed the hack or even asked for it. Intent is the difference between manslaughter and murder and we couldn't technically in any reasonable way commit an accidental hack into a computer system before approximately last month (or last quarter if we consider Mythos previews to be capable of this.)