I guess it falls in the same category of burglars that enter from the unlocked main door. It is still illegal even if there were no security measures to overcome by the attacker.

That being said using an API does require a minimum of computer knowledge