Sitting at a lunch counter is legal, sending an HTTP request to a server is legal. In some cases sitting at a lunch counter for too long becomes illegal, and in some cases sending too many HTTP requests can become illegal (DDoS).

The difference here is that sitting at a lunch counter for too long got you a night in jail whereas participating in a DDoS can easily get you many years in prison and a felony conviction.

There is an imbalance here. Both of these things are acts of protest. Both do economic damage to their targets. Both involve collaboration with others. Why, then are the penalties so radically different?

We could debate the relative economic impact, but I think that's a moot point, just because a business is large does not mean that it should be immune from protest. Political freedom cannot be squelched just because we have decided to rely on fragile technology for day-to-day life.