I guess it depends on how you draw the line between scraping and hacking. We can probably agree that if you publish a list of Marvel superheroes and I download

I guess it depends on how you draw the line between scraping and hacking. We can probably agree that if you publish a list of Marvel superheroes and I download it, that is scraping. If you put it behind password protection and I find an error and get it, then it’s hacking. Now let’s assume you make a quiz which uses the list as answers, taking the quiz is just normal behavior, automating taking the quiz in order to extract the whole list is somewhere between hacking and scraping to me. It’s not “just scraping content” but it’s also not using a security exploit to gain unauthorized access, it’s abusing the systems intended functionality to expose content that was not intended to be published and then collecting it. Obviously someone should’ve be able to get a Facebook account id just by providing a phone number in the first place, but if used as intended the feature is harmless, but if we want to claim this is “just scraping” then Facebook would also be claiming that the there was absolutely not issue in publishing a list of all user accounts and phone numbers in the first place.