There was a wired article that went into some of this in more detail, but deploying fuzzing against a website they don’t have permission to use it on is potentially a lawsuit on their side and depending on the extent of it could cause issues with computer abuse and fraud laws.