[lallysingh]

It's less work to disable them. There's likely already an API access control system in place, for internal-only APIs, testing, etc.

[eridius]

It also means sites can avoid promising to do things that aren't actually possible, like saving information for access next time.