Say a third party app orders the wrong coffee, or orders too much stuff, etc. There's a real business risk because they have to shell out physical capital to make coffee.

I might be slightly off because thinking about it the app probably requires up-front payment. But either way, fully open APIs can cause problems if they're more meant for internal processes

One funny (ab)use case that may not be immediately obvious: any public API that accepts payment for goods via credit card will sooner or later attempt to be used by carders to test purchased/stolen card lists for validity.