Guessing someone’s password is exploiting someone’s bad judgement in choosing a password, not exploiting a system’s weakness. By your definition, if someone leaves their car keys in the ignition, I “hacked” their car when I steal it. I didn’t exploit a weakness in the car. The owner was just dumb.