I think it is pretty clear they did not have privileged access. Either because they never connected to the courseware service, or because they did so with students' credentials.

Edit: I'm not sure if I just missed it earlier or the article has been updated, but this issue is directly addressed now:

> The students were also accused of “disseminating course material” by allowing students to use their own, individualized Canvas API tokens to connect Eightball directly so they did not have to upload PDFs to the tool themselves. “The upgrade did not change what students could upload to Eightball or what learning materials Eightball could produce upon request,” the suspended students’ lawyers note in the lawsuit.