Cybersecurity and internet crime laws are notoriously outdated (created in the 80s). I could see a bad lawyer arguing that cURLing an API repeatedly is “hacking”.