While working on T321799, I noticed that action=growthmentordashboardupdatedata API ignores blocks, ie. blocked users can make use of the API.

For action=growthmentordashboardupdatedata, this is not a terrible problem. The refresh of MenteeOverview data is fairly quick those days, and it would get triggered anyway in a couple of hours, as the updateMenteeData.php script runs every three hours.

It would probably be nicer to check for the block anyway, but IMO, that's a nice-to-have.