There is no indication that they accessed the API improperly.

That link to the CFAA page on Wikipedia does not substantiate your claim.

The statute I referenced specifically prohibits the unauthorized access of servers and access which exceeds authorization. It is not difficult to argue that Uber’s activities fall under “unauthorized access” or “exceeding authorization”.

“Uber accessed a protected computer database to lure drivers away to work for the company even though "the database was protected by 'Captcha' to prevent the sort of automated downloading that Uber's MA team intended to carry out. MA was ultimately successful in hacking the system and obtaining the driver database. Because Uber knowingly accessed a protected computer in order to fraudulently capture its valuable contents to gain a competitive advantage, the hack violates the [Computer Fraud and Abuse Act], as well as California Penal Code Section 502."”

The CFAA is broad by design unfortunately. We’ve jailed people for enumerating customer data by incrementing a query parameter.

https://www.wired.com/2013/03/att-hacker-gets-3-years/amp/