I liked the old solution where XML-RPC was disabled by default and users had an option to turn it on as needed.

Would be curious to know what percentage of WordPress users actually use the WordPress mobile app.