Perhaps I misunderstood, but I read it that the account they got access to was a highly privileged account, which did have general access to all data.

The report didn't make it clear to me if an unauthorised user, or an account with low privilege can still access data they otherwise should not have access to.

If this is true, then I agree it is an IDOR, but I read it as they had access because of their current context.