The REST API cannot be disabled, only restricted

Plugins offering to “disable the REST API” hook rest_authentication_errors and return an error for unauthenticated requests, which is a restriction rather than a removal — the routes still exist and the editor still uses them.

add_filter( 'rest_authentication_errors', function ( $result ) {
    if ( ! empty( $result ) ) {
        return $result;   // something already decided; do not override
    }

    if ( ! is_user_logged_in() ) {
        return new WP_Error( 'rest_forbidden', 'Authentication required.', array( 'status' => 401 ) );
    }

    return $result;
} );

The early return is not optional: overwriting an existing result throws away another plugin’s decision, including a successful authentication. Blocking everything unauthenticated also breaks oEmbed and any front-end feature built on the API, so the narrower version — restricting /wp/v2/users and leaving the rest — is usually the one that survives contact with the site.