An ATM has but one function, assumptions about those seem reasonable (though I think laws against using them without those assumptions are unnecessary, as ATM operators are incentivized already to prevent circumstances in which they lose money). When you generalize that to remote computers, or touchscreen gaming, it becomes less reasonable to force users of those systems to assume the intent of the programmer to stay out of jail.

It's a much more elegant and workable and fair solution to simply let the rule lie with the code, which is defined formally, and let the potential negative consequences of deploying code that is not fully understood incentivize people to be careful about what they deploy for interaction with the general public (be it slots, ATMs, or networked computers).

(An aside, PLEASE stop with the terrible physical analogies about locks and vaults. They are simple straw man arguments. It is impossible to break a lock by force over the internet, or to rob a web service at gunpoint. The intent of a locked door is a safe and reasonable assumption to make, and to punish others for not making. That is simply not so on the internet - a perfect example being spidering email addresses from a public web service that was expressly configured to emit them.)