I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is display

I think you're missing the (subtle) point that is trying to be made. I can go to google.com or HN because I type the URL into a browser and the page is displayed -- I didn't need to go through an approval process or present a security token or anything else to gain access. Now, what if I type in a URL into my browser that happens to look like company.com/users/12345/purchases and it displays a page of information. Did I "circumvent" anything in this case? Did I "exceed" my authorized access? If so, what is the fundamental difference between accessing google.com and this hypothetical URL?