We may want to split this into a new topic, but I don't know how to do that, or I don't have the enough permissions.
Currently, installing plone.restapi does the following:
- Set a few permissions, for example allowing anonymous users to use the restapi.
- Install a PAS plugin, for the JWT authentication token.
- Register a browser layer. This does... I don't know what it does. Something confusing with the Dexterity types control panel. I expected something else. Seems a detail that we can ignore in this little discussion.
Looks like: when you don't install it, anonymous users cannot use the restapi, and they cannot login to it either. This seems fine for Plone Classic.
The restapi endpoints are still available then, and you can call them from Python code. I just tried with collective.exportimport in 4.3, which uses plone.restapi for exporting, and this works fine even when I don't have plone.restapi installed in the UI. That is interesting to know.
I don't know what the "lots of effort" would be. Maybe keeping the dexterity types control panel working?