While the remote API doesn't let you do anything you wouldn't normally be able to do, it does make it a little too easy to write an attack script. Some admins might want it turned off if nobody's using it.