> they aren’t bypassing access controls.
Weev went to jail for accessing public api's, https://en.wikipedia.org/wiki/Weev#AT&T_data_breach
> The flaw was part of a publicly-accessible URL, which allowed the group to collect the e-mails without having to break into AT&T's system.
It was argued that he didn't circumvent, but it didn't stop them from putting him in jail initially.
His conviction was vacated and Amazon has deep pockets and diffusion of internal liability. The illicit state drug charges did not help his case.