You are right. Developing separated REST service is the only way.
But I don't quite fully agree with opinion it can be quite easily done. If you want use all Kentico settings for REST, reuse databinding, authentication and authorization, you will have to make some development on your side...