Hey there,
I agree and thanks for pointing that out. As I briefly mentioned after the callback (perhaps too briefly), the code is for demonstration purposes only. Mocking quickly some data in the API for brevity. For any production ready code, error handling needs to be done, you need to make sure you only return the nodes you want (status check, etc), implement node access checks (using the database abstraction layer), etc.
Thanks!
D