If we are talking of RESTful servers and mention Redis, then we should mention Webdis, which is a RESTful server for Redis -- and it has ACL. https://webd.is/ It is a very old but still active project.

That’s like saying cars don’t need airbags because people should drive responsibly.

Edit: case study: Optus, who leaked pii due to an unauthenticated api intended for internal use only but accidentally exposed to the internet.