This is an intent thing. A protected auth checksum verification step could be the number of letters in the packet and still count, it is not a technical provision

Circumventing a xor by xoring it back is still attempted circumvention.

I started to think about this like physical locks and that made it seem less weird. You don't need a great lock to communicate "this is a private space" and there's no "but your honor is was a crappy lock" defense to trespassing. Circumventing bad copy protection still establishes intent to circumvent so you're still in trouble.

Programmer runs into the fact the law runs on intent and actual happenings rather than the form of a thing, gets confused.

Anything can be a murder weapon too. Kitchen fork. Rubber ducky.