Creating a layer between the core of the game and the scripts, used for creating modifications is, in my opinion, necessary.
You gain several advantages by using this method:
Easier for modders:
A good reason to do this is, as you mentioned, an easier ways to make mods. Writing less lines of code means more readability and minimizes understanding issues for programming newbies. Ideally, this API should be a collection of methods to change something on the game's high level. This means for example: Spawn an entity without knowing how it really gets spawned, or displaying an image with one call, which only takes the image name as a parameter.
You, as a programmer, also benefit from it, as you can write more in less time than you would need with Java.
Preventing people from controlling the whole game is essential. I would not care, if the game would be a single player title, but I would care when the game has got some multiplayer action. Even if it is only a highscore table.
Other people are always frustrated, when someone wins because of cheating (for example: position changes, more specific: position change and direct flag capping). To prevent players from doing so is your main task here.
Keep in mind, that the cheater can always decompile, change the code, recompile and play with this client, so add checks on server side. Generally, the "Security" provided is only another, not 100%-safe option to make life for cheaters harder.