With a physical lock, you'd have to pick the lock each time you wanted access, and avoid being seen. The bar for repetitive attacks on the web is much lower, because you only need to write the "lock picking" script once, and then you can use it indefinitely, disseminate it, etc.

A poorly protected website is more akin a house with no lock on it at all, and reporting that "this house has no lock" is not a criminal act.