Well, if the people writing the code don't care or ignore the valid criticisms - as they often do - then one obvious way to get their attention may just be to exploit the poorly written and implemented code. If they continue to see the problem and don't bother to address it, then perhaps we know their position on the matter.
In any case - as long as the exploits exist, you can expect them to be used and abused. Not that this is necessarily "abuse," but there are certainly some rather easy fixes.
Right you are. That exploitation becomes more complex when the system is not operating optimally. Maybe it is easier. I don't know. We can only find out by trying. I'm not much of a coder but...