If you look at how that is described in the document it appears that such data was actually obtained just by using the API and perhaps some scraping. Not so sure this actually has any legal issues. The API requests being spread over a 2 month timeframe also makes it hard to accuse them of causing any sort of burdensome load on the server.
https://en.m.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
That link to the CFAA page on Wikipedia does not substantiate your claim.
“Uber accessed a protected computer database to lure drivers away to work for the company even though "the database was protected by 'Captcha' to prevent the sort of automated downloading that Uber's MA team intended to carry out. MA was ultimately successful in hacking the system and obtaining the driver database. Because Uber knowingly accessed a protected computer in order to fraudulently capture its valuable contents to gain a competitive advantage, the hack violates the [Computer Fraud and Abuse Act], as well as California Penal Code Section 502."”
The CFAA is broad by design unfortunately. We’ve jailed people for enumerating customer data by incrementing a query parameter.
From competitors like Lyft:
>"Uber had successfully obtained trade secrets with the complete download of its driver database ... It contained approximately 35,000 taxi driver records"
>"Uber used driver and customer impersonation to steal competitor trade secrets. This conduct not only violated the trade secrets law discussed above but also wire fraud law"
From regulators:
> "In January 2017, contacted Jacobs on Wickr and advised they had a bug in a meeting with transport regulators and that they needed help cleaning up the audio."
> "Jacobs heard about the practice of bribing foreign government officials. Based on his knowledge of targeting foreign officials to identify those with influential power, and the rapid insights into new markets"