Making the WordPress REST API read only is sensible decision for small static sites that do not require write access via the API and can be achieved easilyIf you need to create, update or delete content using the WP REST API then you will need to be authenticated. However, I have often found myself when building small static sites to only ever need the API to render content on the front end and no