It is how it works, though not all exploits are the same severity of course.

Say I find a vulnerability in OpenAI's API layer. That might allow me to run requests without paying for the actual token counts, or allow me to read prompts sent by other users hitting the same instance.

Now say I find a vulnerability in the web server that OpenAI's API uses, that gives me remote code execution in the web server process - I can do all of the above, but for any API that they expose, not just the Responses API. I might even be able to serve malicious JS to other users who hit the same server, if JS were also served from it.

Now say I find a vulnerability in the Linux kernel on which this webserver is running. Not only can I do everything above, but I can probably access a lot of secret data stored on this machine, and maybe even infect other machines that connect to it, such as when a dev SSHs into it.

Now say I find a vulnerability for the hypervisor running the VM where that kernel was running. Now I can not only do everything above, but also infect multiple instances, including perhaps access to like a KV cache or model weights if they happen to be stored on VMs in the same hypervisor.

In all of these cases, I am hacking a single layer, but that allows me to gain access to all of the layers above it. Defense in depth makes sure that finding an API-level bug doesn't allow me to break out of the process or the VM, so it limits the damage I can do, but my app is still compromised, overall.