If you forget to lock the door to your house, am I allowed to go inside and start taking pictures of everything?

More fair analogy would be leaving your stuff outside, than inside but under unlocked door.

So if you use a version of Windows that is not updated and has a backdoor, is that fair game for "hackers" as well? It is "publicly accessible" for all intents and purposes. When does it become fair game? In the first day? 100th day? after 2 years?

Even if the info was easily accessible, it seems to me that distributing PII should be against some laws.

I believe so, and that is a fair question. Also, I haven't seen proof that he was the only one. Did you watch the videos he posted? If so, what do you think about the situation?

The whole thing is an awful mess.

Any proof? Did Amazon confirm this? I know there was a file there that said the bucket was public, but that could have been added by the hackers as misdirection to sow doubt.