Agreed, when you want to build an API use Sinatra, and when you want to do web MVC there is Padrino which turns Sinatra into a very competent MVC framework.
I've used Padrino for a couple of projects now, but unfortunately it slips into "Uncanny Valley Rails" territory (particularly when it comes to the rake tasks you expect to have but turn out to be missing, eg. db:test:prepare).
I really enjoy Sinatra and am indeed using it for REST style API hosting, but the counter argument might be all the security stuff that is built into the Rails routes/controllers. this might be a great case for a stripped down rails app as opposed to a Sinatra app.
I thought most of the security in Rails is provided by the rack-security middleware? Or am I forgetting something which Rails provides here?
Escaping everything by default to avoid XSS attacks. that's a nice feature to have.