Can you explain why securing API endpoints against injection is so critical for modern websites and what happens if a hacker bypasses those defenses.