A nonce of your time to discuss what a user can and cannot do.
You don’t know what will be insecure next. You can’t. So secure your code as best you can and secure it better if people point out your shortcomings. Learn. Improve. Protect.
Don’t disable the REST API.
Some more cPanel security for your sites.
Making life more secure, one two factor at a time.