I'm a native speaker and I need to pause for a few hundred milliseconds just to be sure I'm using the right one in a sentence.
A 403 means that it is simply forbidden. You cannot gain the authority to do what you want to do[2] and has nothing to do with credentials, no matter how nicely you ask.
For example, getting a project in your organization may return 401 (simply ask an admin for access), while getting a project in a different organization may return a 403 (you cannot get access to other organizations, ever).
1: https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized
2: https://www.rfc-editor.org/rfc/rfc9110#name-403-forbidden
What does "unauthenticated" even mean here? You aren't logged in, not logged in isn't a state of "unauthenticated", you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense. You can have several sets of credentials and switch between them, not giving them any isn't being in an unauthenticated state its a different thing, and using "unauthorized" in that case makes sense.
That you're not logged in.
> You aren't logged in, not logged in isn't a state of "unauthenticated"
What? Yes it is.
> you haven't given any credentials meaning currently you don't have any authority, so unauthorized makes sense
Ok? Yes, if you are unauthenticated (and authentication is required), then you are also unauthorized. However, the error code is not communicating that you are unauthorized; it is communicating that you need to authenticate, thus unauthenticated is more appropriate.
> You can have several sets of credentials and switch between them
Ok?
> not giving them any isn't being in an unauthenticated state its a different thing
That is exactly what being in an unauthenticated state means. What would you define to be an unauthenticated state otherwise?