Yes, as far as I can tell terms of service violations resulting from things like scraping/using unofficial APIs are not CFAA violations and certainly not criminal unless you are not supposed to have access to the data in the first place. The company may still sue in civil court but it has to be on other grounds. Which is why hiQ "lost" to LinkedIn and settled even though they won on the CFAA issue. And why Plaid is still in business.
The important thing is that it was suggested to use API keys which you are not authorized to use. Just because the keys are technically public it doesn't mean that you are authorized to use them.
If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.
> If someone uploads their AWS token to Github it isn't legal to use it even if it was made public.
I'm pretty sure these kinds of services where you can incur significant charges by using the API have a stipulation in their ToS that any API calls performed with your key are considered to be made on your behalf. Kinda like banks do with online banking, "everything done online under your login is considered as if you've done it at a branch with paper forms". Regardless of laws it's still your own responsibility to protect your credentials.
