>> If a company accidentally leaves a press release for a merger publicly available, I happen to guess the URL, and then I trade on it: Unfair (I have access to insider information that other market participants do not) but legal!

Not necessarily. Just because you accidentally left your S3 bucket open and I brute force my way to the link by guessing doesn’t make it legal. It can still be insider information. Insider information is not limited to people who have a duty to the company. If I break into the companies office and steal information and trade on it then it can be insider trading.