Connecting a third-party API brings specific, real risk: a bigger attack surface, inherited outages, permission scope creep, breaking changes with no warning, ...