It may be useful to consult the opinion in this civil suit. The relevant portion is the state computer law claims, starting p. 22, which in the Nevada and California versions involves a law making unauthorized access a crime. These laws also provide a cause of action in case of damage caused by illegal access (that is, you can sue the person who broke into your system). On that basis (as well as copyright infringement, where the plaintiff prevailed), Oracle sued the defendant.
As the court noted, the core question is whether Rimini violated those laws by downloading the content (using automated tools in violation of the TOS). Crucially, the TOS allows downloading, it just forbids downloading via a particular method. The court said
We hold that taking data using a method prohibited by the
permitted, does not violate the CDAFA. Because the same reasoning
applies to the NCCL claim, we reverse the judgment as to both
Relying on prior case law (US v. Christensen),
A plain reading of the [CDAFA] demonstrates that its
focus is on unauthorized taking or use of information
Rimini did have authorization initially, because Oracle only later imposed the method restriction, and the court ruled that
Because it indisputably had such authorization, at least at
the time it took the data in the first instance, Rimini did not
violate the state statutes.
EFF overstates what the court found: they found that the downloading was done with permission, and the question of criminal prosecution was not an issue.