It depends who you're hacking, where they're based, where you're based, and what you do. If you're extremely careful not to break any of the rules it can be completely legal, as it was in this case. Many jurisdictions make it completely illegal. I agree that $6,500 is a pittance.

Well OpenAI is a small garage startup, it’s probably all they could manage.

And so they told the world ¯\_(ツ)_/¯