This misunderstands the premise. You cannot intuit someone’s subjective experience of reality because it is impossible for you to experience their experience of reality. You have only what they’re able to explain to you.
To come at this from the other direction, if a friend says to you “I’m having a good day” and does not appear obviously distressed, how could you judge the relative goodness of their day or if it was actually good at all?
Tourists have been carving their names into shit for - and I’m not exaggerating here - thousands of years. I"m having a hard time finding evidence for this now, what with most of my searching only returning content for this particular modern incident, but I swear I’ve seen documentaries where they show ancient people doing, essentially, the same thing.
It’s far more likely that Google, AWS, and Microsoft are using tape for high-volume, long-term storage.
According to diskprices.com, these are the approximate cost of a few different storage media (assuming one is attempting to optimize for cost):
The short version is that the creators of this API are doing something more secure than what the client wants to do.
A reasonable analogy would be trying to access a building locked by a biometric scanner vs. a guard looking for a piece of paper with a password on it. In the first case, only people entered into the scanner can get in (this is the cookie scenario). In the second case, anyone with a piece of paper with the right password on it will be let in (this is the Bearer token scenario).
More technical version: the API is made more secure because the “HttpOnly” cookie - which, basically, means the cookie’s contents can’t be read with JavaScript in the browser - is used to hold the credentials the server is looking for.
By allowing a third party to access the application, this means you have to allow methods that can be set “client-side” (e.g. via JavaScript in a browser). The most common method is in the “Authorization” HTTP Header - headers are metadata sent along with a request, they include things like the page you’re coming from and cookies associated with the domain. A “Bearer” token is one of the methods specified by the “Authorization” header. It’s usually implemented via passing the authorization credentials prefixed with the word “Bearer” (hence the name) and, often, are static, password-like text.
Basically, because this header has to be settable by a script, that means an attacker/hacker could possibly inject malicious code to steal the tokens because they must, at some point, be accessible.