And how do they specify which access is authorised/unauthorised in their HTTP responses? How can we determine programmatically which use is unauthorised?
HTTP status codes are not legally binding. EULAs are.
Saying "if the status code isn't 401 then I'm authorized" is like saying "if the door opens, I'm allowed to enter". "Able to" and "allowed to" are not the same thing, especially when you were only "able" because you ignored DO NOT ENTER signs and picked locks.
The fact that you managed to defeat or bypass security measures intended to block you doesn't magically make your behavior legal.