Courts frequently use the standard of whether a “reasonable person would have known” something. They might try to play dumb, but it almost definitely wouldn’t work as a defense. Trespassing laws don’t require signage, a clear structural barrier is enough.
Those examples are perfectly secure if you set the allowed origins to only your domains, or domains you specifically want to allow use of your API.
If someone copied those examples verbatim, they’d end up allowing a website hosted at example.com to call their API. Which I suppose is technically not secure, but I wouldn’t call it very insecure unless example.com was taken over by a malicious user.
His reaction is because Waymo isn’t returning his luggage unless he pays for it. Two complimentary trips still takes multiple hours of his day for something that wasn’t his fault, meaning even that isn’t free. It’s Waymo’s fault, either they fix it, or it’s theft.
Yes, laws do vary by state, but those signage laws typically apply to open land, not internal buildings/structures. A store doesn’t need signage to prevent you from hopping over the counter to where the register is.