Is there a security benefit to host the API in a different domain than
the dashboard or marketing website?
In a word, resilience.
One benefit is that any security blocks which are put in place due to content on the dashboard or marketing website will not impact the API, if the API is on a completely different domain.
(If "marketing" means Wordpress or Drupal, for example, such blocks can be a very real threat!)
I've had direct experience with blocks triggered by the Google Blacklist, and they can impact the domain name and subdomains thereof. If example.com ends up with malware on it, then api.example.com (and api.api.example.com) will get blocked as well.
Moving to api.exampleapi.com cleanly segregates the API so it won't be impacted if example.com is blacklisted.
Why does a subdomain is not enough?
Again, with Google at least, blocks may extend into subdomains as well. Also, DNS-based filters like OpenDNS wildcards will block all subdomains as well.