That's not how CFAA works. Under CFAA if there was anything to indicate that permission is required to access the system, then that's enough even if no actual security features were implemented.