Comment by Bamafan

Even if they added this feature, the API bug would still remain (it would just be covered up by the UI).

A sophisticated enough client user would still have access to the all data associated to the API user.