Were the files listed when going to http://server.com? No, the user had to:

1. Find the server via nmap

2. Guess at some URLs until the server finally responded with some hidden data.

While neither of those would require being an expert in the field, this is well beyond the realm of browsing public websites.

This is incorrect. Actually, yes, the files were in fact browseable and Akamai servers typically front with DNS names that presumably resolve to their any-cast addresses where they use SNI to select content bucket, so there would have been a "friendly" name involved. Going to https://server.com/folder displayed a list of folders and files all hyper-linked and connected as is common on the internet. The fact that the server was initially discovered by way of a crawler, a scan, is irrelevant (this is actually how search engines discover content, btw). The fact that a browser could browse these files suggests that it is not "well beyond the realm of browsing public websites".

Exploration of public areas isn't illegal. There's no law mandating that viewing a website though the browser is legal, and any other means not. Techies legitimately access websites in all kinds of programmatic ways. Intel made their data publicly available. That it wasn't accidental doesn't change that.

Opening unlocked doors, entering and removing property is generally considered to be theft.

The key here is that these services were not advertising their presence.

Theft requires property owners to be denied their property or the use of it.

That did not happen here. Theft is not part of the discussion.

Infringement could be, and is at least the right language for the discussion.

Where are the locks?

There are often ways to beaches and other spaces unadvertised, but otherwise OK to use.

Sure looks to me like a potential landmine for people. Bad practice with big pockets should still just be bad practice with the same consequences for all who don't bother with better practices.

There was no lock on this at all.