I'm more focused on the assertion that "The CFAA isn't super complicated."

Which raises sincere doubts about the commenter's credibility to make such a claim.

How does „you’re not allowed to guess credentials“ mean it’s complicated?

I think that's a massive oversimplification of how the CFAA has been applied.