Yea, it also only talks about bypassing/breaking passwords, what if the user has a sticky note at their desk and the password is readily exposed. Is that considered hacking? Should be. Unauthorized access regardless of how irresponsible the owner of that account is. At the same time you do not need a ToS or banner saying that. (it still remains illegal to break/trespass into someone's home without a notice saying so!)

Slippery slope. I'd gander a guess this will continue to be a case-by-case call.