The real life equivalent would be if a company wrote their secrets on the back of a letter they sent you in the mail, and just relied on you not looking at the back.

There's no security breach, or even unauthorized network request - their service is requesting this data to your machine, from within their client. I think they just aren't thinking about potential repercussions in their testing names.

How would it? The API endpoint is sending the data to the user's device anyway, because the mobile client initiates a request to the API by design.

Inspecting JSON payloads that are returned during normal use of the app doesn’t seem like an illegal activity.