Cant say I actually use the API myself but its the job of the consumer of the API to read and understand it properly and test as well :)

and one could also say that it's the job of the producer of the API to set safe and secure defaults for an API :)

Or provide no defaults therefore solving both problems.

it was changed postmortem

Are you sure? The original complaint was solely about the API. I'd either want a source or someone that saw it themselves.