Use of these loopholes is same as burglars or hackers robbing a bank. Points are equivalent to cash and just because there is a loop hole or a security flaw, it does not make robbery a legal activity. A bank can anytime start a legal proceeding to recover their monetary losses.