As someone who systematically firewalls off the RPC and REST "APIs" to WordPress in order to significantly reduce the attack surface, I find it unpleasant when a key plugin (or a core feature for that matter) wants to depend on those risky features for things that are already running inside the server with authorized direct access (from PHP) to all the data.