This reminds me of a James Micken's quote from "This World of Ours" in response to security people admonishing users for clicking links in email:

    "It’s not clear what else there is to do with computers besides click on things..."

If you have an API with exposed endpoints, it's not clear to the AI bot what else there is to do with the API besides call the endpoints.