Thanks, that's a good point and perhaps a good topic for a future post :-)
How to ensure that the API and the db use different models even if those models are in the same package?
I struggle with this also, I assume the answer is to not have them in the same package. You can also break the application into separate 'domain', 'infra', 'application' modules as documented in [0] with rules on what dependencies are allowed in each module (e.g. domain should not have db or serialization implementation). The problem is that this does create several adapter layers which adds to the mental complexity.