But isn't it a dangerous road where we hold the makers of software responsible for nefarious uses? Paypal does a lot of this kind of fraud detection and prevention, and we all lambast them for it.

Halting payouts to those using the old software leaves legitimate users out to dry as well - whatever they do, someone is going to be miffed. I assume there will be a point in the future when they do refuse service to all the old API endpoints, but they can't rush that.