If a company has a endpoint that is not secured by a password then it's public. You ask the server permission to access the data, just like you knock on someon

If a company has a endpoint that is not secured by a password then it's public. You ask the server permission to access the data, just like you knock on someone's door to come inside. If they open it up, or return you data then you can only assume they are allowing you access. When you start guessing passwords or reusing tokens or trying to access something with a different token, that's a bit different. Lock your door if you want to keep the things inside safe.