[dragonwriter]

> With their API they have to write a bunch of boilerplate code to transform from their SQL db to REST.

Open source tools that will present a simple, read-only REST API over an SQL db with little to no custom code exist (so do proprietary tools, often from DB vendors and sometimes as part of SQL db products.) Same with NoSQL or sorta-SQL storage solutions.

The idea that they have to write a bunch of boilerplate code to do this is false. They might choose to do that, but its defintely not necessary.

> Authentication, throttling, threat prevention, encoding, etc etc.

Again, open source canned solutions that take a little bit of configuration exist for many of those, and some of them are likely shared services that they just point at whatever service needs them.