In reply to mark k..

The discussion continues: https://core.trac.wordpress.org/ticket/39806

TL,DR: more of WP will be depending on the REST API, so disabling the API will bring pain. Some discussions around limiting to authenticated requests only.