Yep, that's pretty easy to do. But I'm pretty sure this was even easier since I don't think they wrote a screen-scraper. They just accessed a JSON endpoint.

> You cannot protect from this sort of behavior outside of completely disabling this functionality altogether. Anything a human has access to, so does software.

You say that like it changes anything. People don't care if it can be protected against easily, people just care if it can happen at all.