Yes. And SCOTUS's problem is that they think the punishment for visiting facebook at work shouldn't be the same as the punishment for stealing company records - and that's fine, and of course something I agree with. But SCOTUS should actually address that directly, rather than going down this weird path of trying to warp the definition of "authorized".
I don't think they are. I think SCOTUS is looking at this, as is their wont, from a legal perspective.
We have two legal systems: civil and criminal. Both of them have the concept of "authorized." What SCOTUS has said here is that whether or not something is unauthorized may be a civil tort claim--you broke a contract--versus a criminal offense--you broke the law.
That seems to be the knot everyone is trying to untie here. It's not illegal for me to break a contract with someone. It is illegal for me to break the law.
Now, if your employer put software on your machine or on their network that prevents you from viewing Facebook, and you work around that restriction, it could be argued that you have now "hacked" their network and gained access you were not authorized to have.
The distinction is pretty clear in the ruling - if you have access, you can do X without it being considered a violation of the CFAA (doesn't mean you can't be fired, or prosecuted for other crimes leading from the actions, or other repercussions). If you don't have access, and you figure out a way to gain access, it is now a violation of the CFAA.
Don't get me wrong, I understand how that can be straightforwardly interpreted as "unauthorized access." I'm advocating for what the law should be, in my view. The idea is to make a bright line that gives a test for mens rea to avoid over-criminalization while not being too unreasonable. I'm sure there could be scenarios I haven't thought of that would turn out poorly.
edit: I certainly don't agree that the distinction between access to a file in a file cabinet and a record on a computer should be significant. I think it's a dumb law. But the unauthorized access test is straightforward. If I work at a company that disallows internet browsing other than for work purposes and I visit my facebook page, I think that's a clear case of hacking under the "authorized access" test, and my only real defense would be that I needed to check facebook for work.