I just published a small extension (funded by Amnesty International Vlaanderen) to prevent the REST API requests still coming through when the site is in maintenance mode.
The extension is CiviCRM native and the structure is based on the CiviCRM User Framework. However, as I have little to no experience with a CMS other than Drupal, I have only implemented the Drupal module. Would be really great if others could add the same trick for the other CMS's!
- check if API request originated from REST (api_key and key in the request)
- if yes, check if CMS is in maintenance mode
- if yes, throw API_Exception with error code maintenance_mode
The extension can be found here.