Of course, one could always disable the WordPress REST API if sufficiently worried and didn't have any need for it.
@colinwalker sorry if this is a stupid question, but if I’m using Indieweb plugins, does it matter if I disable the REST API?