They didn’t even mention “security risks,” assuming there even are any. There are no “security risks” to delivering a little bit of JSON from a scrobbles table that only has text in it, and there definitely aren’t any new “security risks” considering this exact content can be retrieved from another endpoint.