In some situations I feel like there’s some validity to not answering the question and saying what someone should do instead. Like, for example, if someone asked me how to bypass a security mechanism I don’t think it would be wrong to say they shouldn’t do that and not provide instructions for how to do so. Further, you might even argue that it’s unethical for me to provide guidance that I know (or believe) is wrong.
This is why a root cause analysis is so important. I feel like often in those situations, the problem trying to be solved is really a symptom of the issue as opposed to the actual issue.