register_meta() exposes meta fields in all REST API endpoints, which can lead to privacy leaks. To avoid that, it can be called conditionally. Exposing Custom Post Type Meta for Only a Single API Endpoint
I ran into an undocumented and unexpected problem when registering custom post type meta fields for the REST API.