Lol, what an insane take. EVERY project that exposes an API is responsible for securing that. Its not rocket science, its server software 101.
Being free is not an excuse, especially when there are perfectly valid migration strategies, that don't force them to abandon legacy clients.
Fans like you are the reason they get away with disregarding their basic responsibility