Fun anecdote for the technical folks:
For a year or so (around 2015?) it was crazy. As you'd imagine, the app/website just runs against a REST API. So it's easy enough to trace things out in Fiddler or whatever. One time, I got curious and spent an afternoon playing with it. As it turned out, all you needed to make an FP was a couple of IDs. There wasn't any validation. Literally NONE. As long as you had an active session, you sent your session ID, the attraction ID, the IDs for the rest of your party, and the timeslot ...and it would just transact it. No questions asked.
I scribbled up a clunky little app on my phone that would automatically-ish pull the ID from your session and book immediate FPs for every ride in the park.
Eventually, they patched it up of course. Last I looked at it, they stopped letting you actually request an FP explicitly. Instead, you get a list of options and just send back the ID of the option you want.