I believe this is for additional XSS protection - if a user clicks a suspicious API link, the worst that happens is the browser downloads a json.json file instead of rendering a potentially malicious payload.
Sending it as a "file download" has no effect on what happens when the endpoint is called via AJAX, but in the event that a browser navigates to it directly, ensures that even the dumbest of browsers do not render it as HTML.