So, is this just brute-forcing API calls to create a training set? Is this only for supervised learning? Also, couldn't this be done offline, pseudo-legitimat

So, is this just brute-forcing API calls to create a training set? Is this only for supervised learning? Also, couldn't this be done offline, pseudo-legitimately, using your API call log data later on? I don't see how that can be mitigated.