Except I found the documents on Google. It's the equivalent to advertising a yard sale but not realising what you were selling / showing the public.
But wasn't the quote indicating that it was made clear somehow? Looking at the anses.fr site isn't particularly helpful, if that's even the site in question.
Anyway, the point is, it's smarter to be explicit and also opt-out using robots.txt or something similar.
I mean, I've stumbled on FTP sites that allow anonymous users. By providing no password and still seeing content, would I have "hacked" them? It's a configuration issue, and password prompts are just that. Of course, where do you then draw the line? If you call it a security flaw that the documents were public, then accessing them could be an exploit. But... a very flimsy one, since we rarely execute injection attacks to visit websites, but we often click links on Google. The bar is clearly very low. ;-)
This might, of course, change if the access was not indicated on Google but instead on a site like shodanhq.com ...