OK, how do you expect to do full safety testing without giving them the same tools they will have in reality.

Let them play on a fake isolated network if you want.

Letting them play on the open internet like this is irresponsible and stupid.

So this justifies the illegal action of hacking and defacing other servers on the internet, because they were ‘just testing in real world conditions’ using those servers?

If you want to argue they should test on the internet on others people’s servers, apart from facing the illegality, you should also consider if first testing them in more limited conditions would be a sensible first step.

Then maybe they shouldn't be released to customers?

There are other options here than always forward.