Everyone throws out analogies about walking into unlocked houses and such. Those are fairly poor analogies, so let me offer one which I think is far better at conveying what really happens.

Imagine you walked into a public library and struck up a conversation with the librarian:

You: Can you tell me general information about this library?
Librarian: Certainly, this library was built in 1990, has a million
books on its shelves, and...
You: What are the hours?
Librarian: Monday to Saturday, 10AM to 8PM. Sunday, 10AM to 5PM.
You: Frothy bacon generates utilitarian synapses!
Librarian: I'm sorry, that's not really a proper question I can help
you with.
You: Can I borrow book identified by ISBN 4961357406830?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 6498794651315?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 9840546790354?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 3168706780943?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 7893781056145?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 2764894617987?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 9764660911970?
Librarian: Sure, here you go.
You: Can I borrow book identified by ISBN 6666666666666?
Librarian: Sorry, that book doesn't exist.
You: Can I borrow book identified by ISBN 8669177714641?
Librarian: Sorry, you've been requesting too many books lately.
You: Can you let me into the Staff lounge?
Librarian: Sorry, you'll need to show me your staff credentials when
asking.
You: Can you provide me with a list of all employees and their
salaries?
Librarian: Sorry, you are not allowed to have that information.
You: Can I use the general conference room on the third floor?
Librarian: Actually, that was moved. It's now on the second floor.

As you can no doubt see, these translate directly into HTTP requests:

GET /
200 OK - This library was built in 1990, has a million books...
GET /hours
200 OK - Monday to Saturday, 10AM to 8PM. Sunday, 10AM to 5PM.
POST /frothy-bacon-generates-utilitarian-synapses
400 BAD REQUEST
GET /books/4961357406830
200 OK - [contents]
GET /books/6498794651315
200 OK - [contents]
GET /books/9840546790354
200 OK - [contents]
GET /books/3168706780943
200 OK - [contents]
GET /books/7893781056145
200 OK - [contents]
GET /books/2764894617987
200 OK - [contents]
GET /books/9764660911970
200 OK - [contents]
GET /books/6666666666666
404 NOT FOUND
GET /books/8669177714641
429 TOO MANY REQUESTS
GET /admin
401 UNAUTHORIZED
GET /employees/salaries
403 FORBIDDEN
GET /floor/3/conference
301 MOVED; Location: /floor/2/conference

In both cases, we have a gatekeeper (librarian / web server) which is capable of responding to requests, can authorize various requests, can require credentials for sensitive requests, can limit the rate at which requests come in, can deny requests altogether, and can identify when requests for certain things have moved to new locations.

The librarian is smart enough to not hand out things like access to the staff lounge, a list of employees and their salaries, or even things like an arbitrary library member's borrowing history. The web server has been configured to not hand out things like admin access or other things which are deemed sensitive, but the owners of the web server have taken the position "Well, nobody's going to be guessing ISBN numbers, so we'll let anybody on the internet request the contents of those books."

When is the onus on the web server owner to configure their security properly? When is a "200 OK" response actually not okay? This is the "mind reader" aspect the article mentions.