Is writing "harmless" ransomware for educational purposes a gray area or a red flag?

Hi DEV community! I'm highly interested in cybersecurity and OS internals. Recently, I built a small, fully reversible file-encryption script (like a sandbox ransomware) just to test my coding limits and understand how file systems get locked. I only ran it in a completely isolated environment/sandbox. But it got me thinking: Where do we draw the line between 'educational curiosity' and 'dangerous behavior' for young developers entering the cybersecurity field? What are your thoughts on building malware simulations to learn defense?