Personally, I think the idea of purposely trying to maintain private an API designed to be used by code running on others' computers to be morally dubious.

I would agree with your position if this was some internal service of theirs.