Update: As of 5/25/2016, the issue is still not fixed and SoundCloud has yet to reply with a satisfactory response. They’re saying that right holders have the option to disable API requests, but every time I ask if they can show me a screenshot or anything at all that proves this behavior is intentional, their helpdesk no longer replies.
SoundCloud emailed back saying they have introduced an option for right holders to disable all API access to tracks by default, returning this 403 error when requested. They also said it’s understandable that this is a confusing feature, and that they hope to make it more clear.
SoundCloud: please let applications read basic track information. Blocking access from simple information such as track ID breaks so many applications that use your API. It doesn’t make any sense to block access to applications from retrieving a simple ID, title, or duration.
Also, most users who have tracks that are blocking API access have no idea about configuring this, so I’m still fairly convinced this is a bug in the SoundCloud API.