If the application end-user licence agreement prohibits reverse engineering, then reverse engineering is prohibited, no matter if there is some security measures or not and no matter your purposes.
When you walk on the street, the fact that you pass near an open door or window doesn't make this home a public place, and does not make you free to enter in the house to ensure that there is nothing to steal "in order to inform the house holder about the threat". The same logic apply for this API.
If you have any concern, you may get in touch with the software editor. If they are willing to do so, you may have a contractual written agreement from them allowing you some otherwise forbidden actions and clearly stating the limits you should not cross. Actually, some large editors even organize security bounty programs allowing anyone to proceed with security analysis of their products up to a certain defined limit.
But, without such written agreement, the answer seems quite clear to me.
As an addendum, local laws may have some subtleties like what is covered exactly by the notion of "fair use", is it legal to reverse engineer a software one did not install and therefore never agreed to the agreement, etc. You can find some relevant information here and there.
However I would personally not rely on such excuses to be "out-of-jail" guaranties. In France, we had Serge Humpich who, while taking all the precautions to stay within the boundary of the law (all discussions went through a lawyer, longer story here), was condemned when he proved to the GIE (organism in charge of French credit cards) that our payment system was not secured enough. I can also mention the case of Guillaume Tena who was condemned for having proved that the assertion of an anti-virus editor that their product was able to stop 100% of viruses was false.