The scope is what makes it legitimate
A bug bounty scope defines, explicitly, what a security researcher is authorized to test as part of a program inviting outside researchers to look for vulnerabilities — which systems are in scope, which techniques are permitted, what counts as an acceptable way to demonstrate a finding. This boundary is what separates a legitimate, invited security test from what would otherwise be an actual unauthorized attack; the identical technical action can be either one, entirely depending on whether it falls inside the agreed scope.
A researcher's authorization extends only as far as that defined scope reaches — a finding or an exploitation attempt outside it isn't protected by the program's authorization at all, which is exactly why the scope has to be written with real precision rather than left broadly implied or assumed to cover 'anything reasonable.'
Precision protects the researcher as much as the organization
A vague or overly broad scope creates genuine risk for the researcher, not just the organization running the program — a researcher who reasonably believed their activity fell within scope, only to find later that it technically didn't, is exposed to consequences the program was specifically supposed to protect them from in exchange for responsible, invited testing. Writing the scope precisely, and keeping it genuinely current as systems change, protects both sides of the arrangement, not just the organization being tested.