> The difficulty of an attack has nothing whatsoever to do with the severity of the resulting offense.

My point which you gloss over is in the definition of "attack".

Whether browsing to a publicly accessible url with no security is an attack or not, is a very grey area.