the second and more significant problem is that if you ever use JSONP to transmit private data then you've essentially lost the cross origin protection of data

the second and more significant problem is that if you ever use JSONP to transmit private data then you've essentially lost the cross origin protection of data present in the browser. That's assuming the API is using HTTP cookies for authentication, right? If it's not then theres no way for a 3rd party to construct an authenticated request without knowing the credentials. The real problem here is that a JSONP proxy allows 3rd party sites to access the API from your IP address (and API key if you use the suggestion of an API key proxy). Rate limiting and restricting to specific HTTP Referrers would be prudent.