The hardware (terminal) and software (Gaia II language) are perfect - the data (virtual world) is not. When you create intelligent Entities in Gaia, you don't know that they are energy patterns in the third medium - that fact is abstracted away from you. No more than writing static HTML knows that Assembler is actually executing the instructions on the processor. I can't force my static HTML to do something nasty in Assembler because the browser doesn't let me do that. It's a sandbox. The browser can be perfect (as Gaia's terminal and language is) but the HTML can be riddled with problems.
I can see what you mean, Onix. If the language is perfect and the terminal is perfect, how could there possibly be any hacking entities? Surely those would be taken out by the perfect terminal and language? The third part of this is the data, which isn't perfect. Because the data isn't perfect, you can affect the virtual world in ways that was not intended. At no point do you mess with the terminal or the language.
Star Sci, as you rightly point out, can do whatever they want. However, they are stuck with the fixed terminal and Gaia language - so even they are constrained by the limits of the terminals. They could go in and make massive changes to the virtual world to break it but then the general public's Gaia terminals won't be able to go there. They would have to break Gaia within the rules that the terminal and language would understand.
@Viz - I imagine some superb campaigns could be written on the premise that Gaia is fatally flawed and some evil bastard has just found out how.