Not only did they have the option, as I understand it the API was even configured as such since all requests from an app shared the same API key. They’re basically whitelisting like this now but only for the accessibility oriented 3rd party apps.