>Even if they added this feature, the API bug would still remain (it would just be covered up by the UI).

It's not really a bug though. It sounds like DS shows a dashboard for the user absent an instruction to show a different page. That's a reasonable default.

>A sophisticated enough client user would still have access to the all data associated to the API user.

If you use one account to access an API then of course it's your responsibility to control access. How would the API provider be able to do that?