We are used the interfaces being web interfaces.

But say that the underlying api exposes some endpoint discoverability capabilities (eg. Exposing an openAPI spec), then arguably the action was invited: the actions was documented along with the auth model.

If you forget a slip of paper writing "the door is open + your alert shutdown pin" on a sticker outside your house, is it not still an issue if someone enters who you didn't invite?

Unfortunately normies tend to treat APIs like "staff only" stickers on doors.