I agree.
I'm half of mind of just removing the /api/content/<...>/previews endpoint as I don't think the UI really needs it.

They can construct the URLs for the previews themselves and they will have acces to a signature as it sits on the general content object.