That's an excellent question. The reason I didn't is because I wanted to apply different business logic to the API that I can't easily apply to the models. Further, it's more secure this way because everything is explicit and I can also handle the email stuff (which is in a separate table) better.

I could have used a ModelSerializer and overridden the bits I needed to override, but I think the code would have been longer in the end result plus I'd be less sure of its correctness.

I could be convinced that this was a terrible idea, though.