So you are happy with the same class that is used to represent the row in the database including potentially sensitive data also being used in responses to API calls?
I actually agree with you that an API response ought to be a different class, but you probably also want to consider it more carefully than using automation to generate the mapping.