I'm not sure if this is meant as some kind of "gotcha," but the legal system doesn't work that way. He wasn't rotating his MAC address as a default practice. He changed the last byte of his MAC only when he noticed he was banned from the network.

Intent matters. Plugging your laptop into a router you normally don't have access to, with intent to download a large number of private articles, means something. And it means more than "I downloaded a lot of public files off the public internet," which is what Meta did.

All of this is in the indictment, which is worth reading: https://www.documentcloud.org/documents/217117-united-states...

Personally I think it's a shame that digital crimes can result in prison time at all, except for e.g. crypto theft. But under US law, Aaron committed a crime back then, and it would still classify as a crime today.