They should make their APIs secure, instead they abuse DMCA.
It's almost as if they're making the same error as OP who identified the library as "an API" rather than a client of an insecure API implemented by Instagram. Presumably they know better.
What if it turns out they detected this code was run by other people and responsible for 50% of the unauthorized access? Just because it doesn’t entirely solve the problem, does not mean they shouldn’t pursue all partial tactics.