If I send a request to a server and it sends a response back, how can that be illegal?
It's illegal to rob a house, even if the door is unlocked.
That analogy is a poor one. It's like someone left their back door open and when asked "can I come in" they say "yes".
I can send millions of requests to a poorly secured bank server, until I find a username password that gets a "logged in" response back. I can send a request after that to move money, and the server sends a response back with a reciept.
These are all things the server was configured to do. But I think most people would recognize that as theft.
It would be a poorly configured server. Again, the situation is different. Nothing is taken in the case of a server sending you files. It's not like taking money at all.