Only thing what would make it illegal is that they have *some* security in place, it doesn't even matter how dysfunctional it is. Otherwise it would be just public service (at least by the rulebook over the other side of globe).
Why do you think that? I'm pretty sure it's still computer intrusion even if they don't know how to do anything security related. Here's a brick and mortar analogy: If somebody's front door doesn't have a lock, it's still illegal to walk in. And anyway, even if you're right, then having a password, even if it's a default password that hasn't been changed, is *some* security. Intent matters. A lot. Are you accessing their system because you're trying to do something nefarious, or because you accidentally thought it was the free WiFi from the coffee shop next door and you're just trying to check your email?