Interestingly enough, when creating an API key, there is a checkbox to (dis)allow withdrawal of funds using that key. So at some stage in the development, API-withdrawals were planned (and maybe they still are).