Suppose while you were away from your house someone came to your front door and found it unlocked. Assume he entered your house and had a look around, but didn't take anything. He then later notified you that you had left your house unlocked. Did he do anything wrong?
Physical metaphors DO NOT WORK in this scenario. This is not a house or a car or commercial warehouse or anything else... it's a website. There are far too many relevant differences between physical locations and web sites for metaphorical reasoning to work.
Well, we need to know more about the particulars. It says it was SQL injection. It's entirely possible, given the limited information, that he just sent a correctly crafted GET request. In that case, a more apt analogy would be a warehouse where stepping on a particular part of the sidewalk unlocks the door.
My doormat says "GO AWAY", the old school robots.txt.
Your analogy doesn't hold. There are few spiders trying every door and window of every house. The risk profile (attack surface area) is much smaller in the physical world.
If a service publishes a port, many someone's will probe it, legitimately or not.
Where your analogy does hold is courtesy. If one of my neighbors sees my door open, does a walk thru to check things out (I might be bleeding out in the basement), finds nothing, then I absolutely do want her/him to clue me in.
