It says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific

It says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs. You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger. And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".