Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff

Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.