Oh, absolutely. It’s not something which should be encouraged, and against a well designed modern system it probably isn’t possible (there must be some challenge-response type NFC systems on the market).

I’m just saying it isn’t unambiguously “illegitimate”

That’s probably debatable, if they have permission. They probably shouldn’t have been given permission, but that’s a separate issue