I'd weigh that up against the very real risk it is mis-configured by someone's nephew and exposes my private data to anyone who asks.

I think mandating API for certain industries like banking is a good idea, but I'm not so supportive of having it apply all the way down to my local hair salon. They have enough to worry about.