Things to consider when creating an open-source web API wrapper over an undocumented API

I have always looked at websites and their use of internal undocumented APIs, which more often than not are undocumented to the outside world. But of course, we can explore how the API is used by their frontend GUI (and can be detected by Wireshark). Some examples include Yahoo Finance and (previously) Google Finance. I can assume that there are many other examples where they use another API to do processing to relieve any load on the client side.

What are the implications of using the data provided by the existing undocumented API? I assume some issues may include ToS breaches and being sued or receive a cease and desist, and undocumented API changes.