Reading through the linked blog post, i notice the line:
Login methods that don’t use OAuth can’t be made public for security reasons.
Is this something to worry about?
Seems kinda suspicious. Sounds like Security Through Obsurity.
"If know one knows how it works they can't hack it."
Or that their are known bugs in the (nonOAuth) logon methods that leave them insecure, and they are more exploitable through the API (but that means they exist, and can, with the right tools be exploited anyway.)