There absolutely is a need for API endpoints for every single feature present on the web application. What if someone wants to make their own custom client for GitHub?
Curbing automation is not a valid reason for its omission. I can reverse engineer the web page, figure out how it does it and implement it in a script if I want. People have done this to YouTube and Twitter, they can do it to GitHub too and there's absolutely nothing they can do about it.
Sure, people can do that. And people diving into janky private APIs know that they're taking a gamble, and that things may break at any time. That doesn't in any way oblige GitHub to support them.
I absolutely agree -- starring repos should be a human act, not an automated one. No need for API exposure of this particular action.