Hasn't there been cases where people got charged for unauthorized access to computer system by simply changing some identifier in the URL?

Data being technically accessible doesn't mean it's meant to be accessed by anyone.

If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.