Since WordPress version 5.5 a permission_callback is needed for register_rest_route. I think the endpoint should only available logged in.

( ! ) Notice: register_rest_route was called <strong>incorrectly</strong>. The REST API route definition for <code>cf/cf-get-comments-api</code> is missing the required <code>permission_callback</code> argument. For REST API routes that are intended to be public, use <code>__return_true</code> as the permission callback. Please see <a href="https://wordpress.org/support/article/debugging-in-wordpress/">Debugging in WordPress</a> for more information. (This message was added in version 5.5.0.) in /wp-includes/functions.php on line 5311