Agreed, however if a government official says “These records are confidential, please don’t look at them” and then they leave them on a park bench in front of you, then it is a felony to for you to look at them.

In this case, it would be like going through the UI and trying to access the record and getting denied because of a client side access block, so you make a direct call to the backend instead to retrieve the record. You’re making a perfectly legitimate HTTP request but for something you know you shouldn’t be able to access: illegal.