So I'm going to start from the sweet part: REST service. Kentico REST service is really flexible and gives you access to all objects and pages within the system and when talking all, I do not mean all standard, but any custom page type, custom table and any objects from custom modules.
Retiving data with REST service
First of all Kentico allows you to configure what type authentication you'd like to use for the REST service. Most likely you'll use Forms authentication for web site. Also it allows you to specify whether you want to access pages or object with REST service as well as you might specify which page types or classes exactly you want to access. You might allow only read access. With Forms authentication you may allow or deny some role to access particular section of your web site or object and system will handle this appropriately. Also you should not worry about SQL injections, as Kentico is secured from such.
Comsuming REST service
The only drawback I can think of is fact that you can request only one object per request, no joins are available, no views are accessible with REST service. It might be a pain when you'd like to get a structure, e.g. user along with user settings. This example is not the most complex, sometimes you might need to retrieve really complex structure. You might send several request from the web page, which is not convenient, but possible.
Please leave your questions or suggestions in blog comments.