How does „you’re not allowed to guess credentials“ mean it’s complicated?
I think that's a massive oversimplification of how the CFAA has been applied.