If the operators of a site post them in such a way that anyone with a browser can access them, with no login or other security precaution required, and not even any notice that the files are confidential, they are implicitly inviting anyone to view them, and thus it is legal to do so.
There was a case where a site owner gave specific notice to a user not to access the site, and blocked the user's IP. When the user hired a proxy service to get around the blockage, this was held to be unauthorized access, a crime under the CFAA (Computer Fraud and Abuse act). But in that case the individual notice was considered essential to the applicability of the act.
That case was Craigslist, Inc v. 3Taps, Inc et al, 942 F.Supp.2d 962 (N.D. Cal. 2015). See also This Wikipedia article and thisJaxEnter article. As the Wikipedia article put it:
Craigslist Inc. v. 3Taps Inc., 942 F.Supp.2d 962 (N.D. Cal. 2013) was a Northern District of California Court case in which the court held that sending a cease-and-desist letter and enacting an IP address block is sufficient notice of online trespassing, which a plaintiff can use to claim a violation of the Computer Fraud and Abuse Act.
Note that in this case web scraping was apparently impacting the craigslist site.