It's an artificial distinction, though.

Code *is* data, though. The days of hard-wired consoles where people had to unplug wires to reprogram computers are long gone. Computer programming is "just" an act of configuration (simple to state, hard to do!)

So is editing a configuration file. The more options the configuration file has, the closer it is to being a "language" in it's own right.

If it's easier for the programmer to edit the source code and rebuild the application, then that is sometimes what should be done.

If it's easier (or cheaper, or company policy, or whatever) for the end user to do some of the configuration maintenance, then that is what should be done.

The same level of testing needs to be done in each case; the application must be proven to work with the new configuration, be it compiled in, or edited. Solid blackbox testing always assumes a computer program will blow up when handed untested inputs...