I agree, but I can also see their reasoning. It's much easier to script and abuse an HTTP form than it is to abuse a (presumably more locked down) phone app with access to a closed API.