"Good security practice" is to follow Kerckhoffs' Principle:
One ought to design systems under the assumption that the enemy will immediately gain full familiarity with them.
Not following Kerckhoffs' principle means you're doing security through obscurity. A quick google will show you what the community thinks of that.
And how would they know what data/arguments they need to send in order to make bad use of any of the API functions?
Maybe through a brute-force crawler. Maybe they somehow get access to your WSDL or Swagger files containing the full description of the API. Maybe they get access to your client app or SDK and reverse-engineer the API. Maybe they sniff traffic and observe people using your API. Maybe other methods.
It's clearly up to you whether adding auth is within the scope of your project, but having APIs that serve or accept sensitive data with no auth is very much bad practice. Better yet is to have access control on top of auth to control who can view / set which data.