Terrible analogy. A webserver is not at all like a door. It doesn't block or allow traffic to and from your file system.

A web server is more like a receptionist. It handles requests. "Can I have your basic catalog?" "Certainly, here you go."

"Can I get this item from your basic catalog?" "Certainly."

"I don't see it in your catalog, but my buddy said he got this other item from you. Can I have this other item too?" "Absolutely."

"Can I borrow your stapler?" Sure. "How about a pad of paper?" "Of Course". "Can I just have the contents of your supply closet?" "Here you go." "How about your accounting files, can I get those?" "No problem!" "How about your entire customer list?" "Consider it done!"

When you hire a receptionist and specifically tell them to give customers anything they request, that's entirely on you. You have to at least make a token effort to restrict access to only authorized users before you can even claim that a particular user was unauthorized.

This wasn't burglary. This was putting up signs that say "come in" and labeling everything in your house with "free" stickers.