In my view, if your web server responds to an arbitrary HTTP GET with the asset and 200 error code, then your intention is that the asset is public and any browser can request it. If you don’t like a particular request, return 403 and get on with your life.

I am sure that they can change that if marek requests it. But he doesn’t instead he wants a two year consulting contract where he continues to work on his own project.

I'm interested in the legality of what they're doing.

But it seems very similar in concept to automated web scraping, which has been deemed legal in the US.

The U.S. legislature hasn’t touched computer laws in forever, so an armchair guess is hard, but chances are that causing an extreme financial burden by hotlinking someone else’s images is illegal - although maybe the fact that fakercloud could just block hotlinking based on the referrer header means it’s not as open-and-shut of a case.