AWS API Gateway Mock Integration Cost/Risk

Mock integrations are just like any other integration, with the difference that they return a fixed value and do not actually invoke a backend. They can be used for testing your API, but for other things as redirecting one endpoint to another.

You should protect it as you protect any other endpoint. There are cases when you need to protect and others when you do not. It depends on the specific use case.

Mock integrations cost the same as any other endpoint (from API Gateway's point of view), but there is no additional cost for a backend.