I am currently on Magento 2.2 Commerce instance. We ran into similar issues when we found spammers were creating accounts by hitting the customer APIs. Magento support stated some APIs remain open because the app uses these internally. For example, some APIs are used for guest checkout process.
Some of these can be seen by reviewing underlying code:
<route url="/V1/customers" method="POST">
<service class="Magento\Customer\Api\AccountManagementInterface" method="createAccount"/>
As you can see the resource is hard coded to allow anonymous. So basically some APIs will not adhere to configuration settings in the UI.
I would recommend starting by reviewing the webapi.xml file of the particular API you are concerned about. If you really want to change this you will need to do a customization that overrides the resource in the appropriate webapi.xml file.
Personally, I am not a fan of the approach Magento took. In my view, open APIs are a bad practice. I did put in a feature request asking Magento to review this issue and have a solution that would not require anonymous access to the APIs.