[banannaise]

Seems likely that they used an allowlist rather than a blocklist for the API restriction, and left several critical services out of the allowlist.