The government doesn’t need to be handling legal affairs with individuals violating a company’s store policy. If the company wants to take action the company can sue the individual and the court system can handle it. The government shouldn’t be acting as a police for companies that have billions of dollars more lying around collecting dust than the government does. Besides, if making it illegal is an attempt to deter, then the individuals involved won’t be revealing vulnerabilities in company websites, leaving those sites open to attacks from foreign governments, which our government can’t police even if they wanted to. Better to have website vulnerabilities exposed by domestic citizens with no more ill intent than to buy excess merchandise than for said vulnerabilities to be discovered by China and used to take control of our communications infrastructure.