Can anyone bypass Secure Fields via API or exports?

No, we have foreseen such attack routes - Secure Fields cannot be accessed by either of these methods. If you want to focus on security, choose the secure search option as well.