Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the dif

Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access. The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well. That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.