Using MAY when talking about what an attacker could do feels weird, I don't know any attacker that concerns themselves with normative compliance. The [normative meaning](https://datatracker.ietf.org/doc/html/rfc2119#section-5 of MAY] reads:
MAY This word, or the adjective "OPTIONAL", mean that an item is
truly optional. One vendor may choose to include the item because a
particular marketplace requires it or because the vendor feels that
it enhances the product while another vendor may omit the same item.
An implementation which does not include a particular option MUST be
prepared to interoperate with another implementation which does
include the option, though perhaps with reduced functionality. In the
same vein an implementation which does include a particular option
MUST be prepared to interoperate with another implementation which
does not include the option (except, of course, for the feature the
option provides.)
Using
MAYwhen talking about what an attacker could do feels weird, I don't know any attacker that concerns themselves with normative compliance. The [normative meaning](https://datatracker.ietf.org/doc/html/rfc2119#section-5 ofMAY] reads: