Just because company failed to limit access does not mean it is public data. Just like stuff not being screwed or glued down doesn't mean you are free to take it.

The federal government outlaws "knowingly accessing a computer without authorization or exceeding authorized access" to obtain information from any "protected computer" (which, in this context, means any computer involved in interstate commerce - which, in practice, has been ruled such that it certainly includes any Internet-connected server of a corporation).

Your defense would have to be that you were authorized to access the data, or that you did not know that you weren't authorized to access the data. Not merely that the data was easily accessible.

It’s not public data. Just because it is unintentionally publicly available does not make it public data, except in the strictest, most pedantic interpretation (that would never hold up in front of a judge).