I feel like an asshole posting a criticism of the whole dependency category every time they get a critical vuln.

But if you are building an API service, you don't need an API Management dependency. And it's an additional attack vector. You (as in an engineer or as a company that provides an API service) need to do the actual undelegable job of building an API, just do the work, do the HTTP server, do the rate limiting, do the OAuth integration.

Verdict: Time to uninstall software in the category of API Management. That is, if you want to be the very best. If you want to be mediocre, sure use some middleware that provides API, slap some API into your software so that customers that ask for API have API. Otherwise, engineer an external Application Programming Interface into your systems.