“But the court ruling says: yes, there was a password, so there is a protection mechanism which was circumvented, and that’s hacking.”
A developer found plain-text MySQL credentials in a vendor’s app that exposed every one of its customers. He reported it, the vendor fixed it, and then the vendor pressed charges. A German court convicted him because a password existed, however publicly it was printed. Vendors ship the hole and researchers get the criminal record.