Ya know, I'd feel better about usernames being in the public API if a 2FA of some sort was implemented into core. Until that happens, most my client base doesn't care about author names so I'll continue to block or redirect anything referring to them.