I fully agree. Any error should not return a 2xx code. All clients should be safe to assume that 2xx is cool and they can just move forward and use the output. If suddenly 2% of your 2xx responses are errors it becomes fun time to sort out where data got corrupted a few months after you started to use an API. Handling errors as a client also becomes nasty.