Why does OpenSearch restrict the /_security endpoint?

When calling endpoints beneath the /_security/* endpoint I get the response:

{"Message":"Your request: '/_security/..' is not allowed."}