As much as I'd like to make the argument "SQL injection vulnerabilities are your own damned fault" at this time, I understand it wouldn't be compelling to you.

As much as I'd like to make the argument "SQL injection vulnerabilities are your own damned fault" at this time, I understand it wouldn't be compelling to you. We'll table that for a moment, and similarly we'll table the obvious "Why the hell should using a public API in the way it was intended (e.g., incrementing an ID param in a public endpoint) be illegal?". Instead, I think we should look at the authorization angle. The company in question appeared to be using the widely accepted OAuth scheme for exactly the purpose that it was intended: acting on a user's behalf to get data (here, contact information). That's why the whole thing exists, and that's why companies like Facebook and Linkedin have as much information about their users as they do--because they themselves pursue this exact behavior. It seems kinda incongruous to say that user authorization is fine when you have the lawyers to back it up, and not fine when you don't. This seems like Facebook being anticompetitive against the wishes of their users.