Just curious as an academic matter here. What’s the legal risk from an exploit like this? Is the idea that manipulating URL’s like that for the victim site amo

Just curious as an academic matter here. What’s the legal risk from an exploit like this? Is the idea that manipulating URL’s like that for the victim site amounts to unauthorized use of their computer, hence CFAA stuff? Just curious how an expert would draw the line between black hat SEO and TOS violations and actual illegal acts.