I filed a ticket to disable REST API by default, making it opt-in rather than always-on: https://core.trac.wordpress.org/ticket/39806#ticket