I think the bar to whether something is an "illegal data breach" or not, should be whether the security is half-decent according to most security researchers. B

I think the bar to whether something is an "illegal data breach" or not, should be whether the security is half-decent according to most security researchers. Because in cases like these (and the one where someone almost got arrested for clicking "view source"), the vast majority of security researchers will agree that the security was terrible and irresponsible. Even scraping public data could be a gray area e.g. if you're scraping a huge amount of possible addresses or de-aggregating on a massive scale. More importantly, you could say that you are doing this, e.g. claim that you found a "secret" 64-bit key by evaluating every possible one. But if your data is accessible via simple API requests, clearly there is limited "guessing" or brute-force going on.