This applies to any paid API and is something we check for when we do security audits, definitely not a "first of its kind". It's just not common that APIs that cost 20 cents per invocation are exposed directly to the general public.