CFAA is very broad. "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— C) information from any protected computer;"

A court could see "ambiate was authorized to use the work printer for printing -- ambiate hacked the printer to find out the fax machine number and sent a fax" in an absurd world.

This random internet person was never authorized to access this public router. Even if its set to a default username/password. That's the broadness the CFAA.

Just because you set your password to 'password99', doesn't mean you get more protections than the person who leaves their Cisco router set to 'cisco'.