In 2016 the concern was about accessing other people's data through open APIs, not accessing your own data in your own apps. Moreover, the problem in 2016 was

In 2016 the concern was about accessing other people's data through open APIs, not accessing your own data in your own apps. Moreover, the problem in 2016 was that a disingenuous company could exploit one user's account, under false pretences, to access their friends' data without any consent at all. Having an open API doesn't mean you can't require authentication and authorization for requests, and having a link to something doesn't mean you have permission to access what's at the other end of that link.