Hasn't there been cases where people got charged for unauthorized access to computer system by simply changing some identifier in the URL?

Data being technically accessible doesn't mean it's meant to be accessed by anyone.

If I understand this right, this is the equivalent of leaving a house key hidden under the doormat. Just because it can be easily found doesn't mean anyone's just legally allowed to use it.

The precise term is 'inadvertent disclosure'.

https://csrc.nist.gov/glossary/term/inadvertent_disclosure

While you are technically correct, in practice the democratizing of a tool that can be consequential in leaking your private information should come with stronger safeguards and educational opportunities for those who aren’t well versed in technology.

Lovable lets you do stuff without even understanding semantically what API or API Key means and how it can or should be used.

Moving too fast and putting the onus at the user is a bit shady.

I think it really depends on the data itself and jurisdiction. There's very real chance just having more data than you need to prove the exploit exists could open you up for potential legal liability (especially if the data itself is sensitive). Imagine a situation where the researcher gets compromised after the fact with sensitive data lingering around on their machine.

around jacquesm's insistence that this is a breach.

I mostly see an accusation of downloading more data than needed to prove the point.