Why? The api has to be secure. Mobile os keeps the app safe. Where is the attack surface?

You don’t believe how often people leave secrets in the app or use webviews and iframes badly, misconfigure OAuth in client side and so on. There are many issues where secure API does not help.