Maybe they even put "security through obscurity" in the endpoints. Certainly, their comment makes it seem like they assume their own client code is needed and

Maybe they even put "security through obscurity" in the endpoints. Certainly, their comment makes it seem like they assume their own client code is needed and they don't want to provide and document a stable API for third parties.