Couldn't it be argued that clicking links on a web page are no different from changing an ID in the URL? Web pages contain loads of URLs. You can't tell if you

Couldn't it be argued that clicking links on a web page are no different from changing an ID in the URL? Web pages contain loads of URLs. You can't tell if you have the right to access the content behind it. The URL itself is simply an address to something - or nothing (404). Having an ID in the URL is a compact way of signaling a huge list of URLs. Thus, the kid simply followed links published on the website.