A 200 response means the server accepted the request and is returning what was asked for. It is the most common status on the web, and it is easy to read too much into it.
For defenders, a 200 does not prove that nothing bad happened. An attacker's request that reaches a vulnerable page may get a 200 as well, because the application ran as designed or because the harmful action happened in the background. Some applications return 200 with an error message in the body, so a status check alone does not separate success from failure.
For attackers and scanners the code is a signal. A 200 on a path like an admin panel, a backup file or a management endpoint tells them it exists and is reachable, while a 403 or 404 suggests it is protected or missing.
When reviewing logs, look at the status together with the method, the path, the size of the response and what came before and after. A burst of unusual requests that all return 200 is more worrying than the same burst returning 403.