I believe the OP is correct about this - you cannot retrieve non-public coordinates for your own observations through the api without an OAuth token, and you cannot create one except through the application process described.
I believe the purpose of this restriction is to ensure people are familiar with the iNat community and application before attempting to make authenticated requests that have the power to make database changes. As such I won’t list the details here, but I’ll just say that it is extremely easy to make 10 legitimate improving identifications without any identification/taxonomic expertise whatsoever.