This is due to the fact that anyone can open a browser, open developer tools and check every request that is being made to Instagram without any limitation.
On private API is different (at least for android), since you have to modify the APK to avoid all the certificate pinning and hardcode your proxy settings. This is obviously easier said than done since all the code is obfuscated.
But yes, alot of people use it. I could get an old account of 2 years to follow 800 people in a day.