If you set up a server to respond to only people you choose, it's on you to make sure it's only people you choose that use it. Then you can make any restrictions you want and invalidate access for anyone who goes against your rules
The web is open. If you put your a chair out in a public square with a sign on that back that says, "Only paying members can sit." don't be surprised when someone random sits in it.
A better analogy would putting your chair in a private room with a locked door and sign on the door that says ask management for access to the chair. Anyone who breaks in to use that chair definitely knows they aren't supposed to be there.
Do you really believe that?
The lengths people will go to justify Uber is amazing.
> The Lyft API is authenticated
In other words, the door was locked and you gave the key to a guy, who then peed on the carpet. While that was impolite, he was definitely not guilty of breaking and entering.
Also did Lyft know they were giving the key to Uber? If someone impersonates your dog sitter to get the key to your house, they still did not have permission to enter your house so it's still breaking and entering.