Exposing Custom Post Type Meta for Only a Single API Endpoint

I ran into an undocumented and unexpected problem when registering custom post type meta fields for the REST API. register_meta() exposes meta fields in all REST API endpoints, which can lead to privacy leaks. To avoid that, it can be called conditionally.