That sort of vulnerability scanning is at best legally dubious, and almost certainly illegal under CFAA and similar state statues when there's clear criminal intent. That's why the 2022 DOJ guidance regarding non-prosecution good faith security research was such a big deal at the time.

> IMO that's the same as going on the street door by door and checking if one is left open to steal everything inside the house...

From experience: this does happen regularly in some neighborhoods of some cities in the US, and even that isn't always an enforcement priority. So lack of enforcement on the internet, where most the perpetrators probably aren't even in a jurisdiction with an extradition treaty, isn't exactly surprising.

Unauthorized access is not legal, it's just not enforced in the slightest.

Illegal and actively enforced are different things. Report it to the hosting company originating the abuse and they usually don't care.