Restricting access to the REST API is a right approach. Everything depends on what you have and what you want to get. If someone, for instance, has an online business that is based on a WordPress powered website, having unrestricted access to the REST API is not good. If some enthusiast has a tiny blog that costs literally nothing and he or she has a lot of time to waste it on solving security and compatibility related issues, why not to play with some weird/unstable/unsupported plugins or themes?
The author of CF7 will not fix anything because there is nothing to fix. He has replaced normal way of processing forms with REST API intentionally and he, apparently, supports the idea of the unrestricted access to the REST API.
So it’s up to you/me/us. Being a part of the crowd and follow someone’s lead or do what you consider reasonable, according to your preferences.