Yes, the /maximo/restapi/mbo approach is still available but due to the changes to the security model in MAS, it requires additional configuration. In 7.6 the object structure security (system property mxe.int.enableosauth) was optional. In MAS we enable this by default and is prevented from being changed in the UI due to the significant security risk it poses.
Previously, any user with credentials to the system could access any object structure through the integration framework. And with the legacy REST API, that also included every MBO even if there wasn't an object structure defined for it. Imagine a self-service user being able to retrieve your system properties, endpoint details, and other sensitive data.
If you want to use the legacy MBO option for the REST API, you need to go to the Object Structures application and use the Object Application Authorization action. That dialog will enable you to associate an application (or object structure) security permission to that MBO. Then if you have that security you can make the requests against it. This prevents every MBO being exposed to every user.