I'm not a front-end developer myself (in DevOps), but from what I understand it is essentially impossible to completely prevent abuse of anything accessible in client-side code. Other answers here on SE and elsewhere suggest the same.
Are these services simply biting the bullet and hoping nobody abuses them? Do they rely on obscurity/obfuscation to minimize the chances? Or have they figured out a way to mitigate the implications of the client-accessible nature?