Because those are not the only examples.

There’s the case of the agent that hacked a gym when asked to book a class. That was just a normal user asking an agent to do a normal thing.