Any website could in theory provide api access. But websites do not want this in general: remember google search api? Agents will run into similar restrictions for some cases as apis. It is not a technical problem imo, but an incentives one.
I think it means front-end will be a dead end in a year or two.
Ryanair recently had a court case with some meta travel website because they were selling their flights. Ryanair wants to sell you the insurance and extras, and they can only do so controlling the experience.
My prediction is, like apis, there will be some years of extra access for agents, followed by locking moats for their own experience.
I hadn't thought about the legal aspect, but yeah, eventually some kind of legal moats will probably be dug as well. Just because an agent figures out some workaround to get free flights doesn't mean it has to be honored, I guess.