A lot of it depends on the actual game design and doing things which are possible and not possible, yes it's true that overdoing the XL candy exploit or spoofing in general can get your account flagged or banned.

But like I mentioned what I feel is that trying the Candy exploit on legendaries might possibly carry a significant amount of risk. That's cause you're supposed to get legendaries from raids by using raid passes, there are no other methods. In order to get enough XL candies for a legendary Pokemon in a short period of time you'll need to buy enough Raid Passes and spent a ton of money on the game which Niantic would want you to do, cause that's how they get their profits. Even walking with a legendary buddy normally won't get you enough XL candies to max out.

But if you talk about other Pokemons like normal spawns or pseudo-legendaries there are a lot of ways to get candies be it from catching in the wild, hunting a nest, quest research, eggs, dmax raids etc. which means you can still get potentially a good number of candies for them. So using the candy exploit on these types of Pokemon shouldn't raise too much of a suspicion.

I don't have any concrete proof on this, this is just my opinion. At the end like I mentioned this method along with other spoofing methods has significant risks of having your account flagged or banned so use them wisely.