In defense of the "it's security!" position (which is not mine): I think they mean a similar vulnerability could exist on the client side of the API. As in someone sends manipulated media that targets a vulnerability on the third party device, the media gets forwarded through the API, now that compromised third party device does bad things over the API.

Personally, I think that it's really just a convenient third party lockout excuse, but the argument isn't quite as bad as it may seem at first glance.