I think you're right in that I don't explicitly say "never do that", but rather strongly discourage it for many reasons. You provide a strong case for disallowing it altogether, at least when behind an API.