Blender and games run great on my M1 MacBook Air which doesn’t get hot even with no cooling at all except via the external case and I mostly play games on the couch with the laptop on my lap.
After two or three hours with all 8 CPU cores and the GPU both pegged under 100% load, I can notice the heat on my bare skin but it’s not uncomfortable. And it only does that in games - Blender gives the CPU/GPU enough of a break between renders to keep it cool.
The MacBook Pro, which does have a fan, is definitely not going to get hot. Forget about that issue. The fan will make it run cooler, and also faster since the CPU won’t be thermally throttled (my M1 is permanently thermally throttled while playing games… still fast enough to get good framerates at moderately high graphics settings though);.
Just buy the most expensive one you can afford. You’re going to love it. The only thing to be aware of is external display support, which isn’t very good on the low end models… but the M3 MacBook Air has improved that significantly and Apple has said there will be a firmware update to the M3 MacBook Pro soon to do the same thing.
API requests are usually encrypted with SSL and protected against unauthorised use with something along the lines of a JWT: https://jwt.io/
Breaking through the SSL might be possible, if the developer doesn’t pin certificates, but you don’t know the secret used to generate the HMAC signature (blue section of that website), then you can’t simulate the API request. And the secret shouldn’t be sent over a network connection.
You could probably access the secret with enough work, but it would be a lot of work. You’d have to do it separately for each app. And the developer can change the secret whenever they want. The developer will change the secret at the slightest hint of anything like this being used with their app. And possibly also take additional steps to keep it from being accessed (e.g. store it in the Trusted Platform Module or equivalent on Android/iPhone). Even the CIA can’t access that - it’s mostly intended for payment processing and protecting data on a stolen phone, but there’s nothing stopping a weather app from using it to prevent unauthorised access to their API (weather data is very expensive, and often billed per API request).
Running the real app on a real phone though… basically nothing an app developer can do to stop that.