Adding a traversal hook to plone.rest is actually the way to go I think. This has been on my todo list since quite a while. It would also make debugging easier because you can see the actual requests right in the browser and you don't need to use curl.
I don't want to start an argument here because Hector is a super nice guy in person. Truth is though that his behavior regarding that issue reduces my motivation to work on it (in my very limited free time) to zero.
This issue is and never was a blocker.
Regarding existing calls. I would keep the content negotiation part of plone.rest in place. You can use both content negotiation and the /api hook to trigger plone.rest.
I created an issue in the plone.rest issue tracker:
Please let's try to keep the technical discussion there.