Restricting this endpoint to OperationType.UPDATE or OperationType.ADMIN means that someone with PermissionLevel.VIEW would not have access to registration views.  Plus, there's nothing sensitive in this data, so if someone calls the endpoint in sees the JSON, I don't see any reason for concern.  It would add complication for our code, but not provide any significant value, that I can see.