Curl command for API subscribe

This will work:
curl -X POST -L -F '' -F 'FIRST_NAME=John' -F 'LAST_NAME=Doe' -F 'NEWSLETTER_CONSENT=1'[LIST_UID]/subscribe
So someone could make an attack to this form via API and fill your database with trash?

The only thing they need is the list id...
Very unlikley. The list unique id itself is not something easy to get. Secondly, emails must be verified to actually be used, and thirdly, you can enable recaptcha and end it all.