Not sure if this has been mentioned before, or if this is normal game mechanics.

But I was running a calming amp, and got hacked. At the time the calming amp still had roughly 1.15 hours left on its duration. Not a major issue, and I doubt people will run into that scenario often but its there.

Having a halcyon trap/calming amp on doesn't stop hacks or raids (on the chance you're disabled before/as the halcyon trap is triggered). Calming amplifiers only stop people from hitting the Attack button on you. If you disable yourself with one on, or someone disables you as the halc trips, you can still be raided. Likewise, with a halc or a calming amp on, you can be hacked. Not sure if it's intentional, but that's how it works.

bah, just put a firewall trap and kill them all

I always hack pacified/truced ships - it's a free pass since they can't return the badge without losing the effect, and they have essentially said "I'm not PVPing right now".

tl;dr; I do this to other ships all the time, definitely normal game mechanics.