Show custom post type endpoint in REST API just if user has capability

The REST API has no parameters, options to solve this – in my opinion. But you should register only if the users have the capability in his role, like the follow example.

add_action( 'rest_api_init', function() {

    // Exit, if the logged in user have not enough rights.
    if ( ! current_user_can( 'edit_posts' ) ) {
        return;
    }

    // Register Meta Data.
    register_meta( 'post', 'foo', array(
        'show_in_rest' => true,
    ));
});

That’s fire the custom data in the REST API only, if the user have enough rights, capabilities in his role. My register_meta() is only an example, that should also work with your additional parameter for register_post_type, like $wp_post_types[ 'cpt' ]->show_in_rest = true;.