In the attached image, the limit is 3 and the numCursors param is set to 10, so the API should return 30 (or 33?) results back. But here it's returning 54, which is the total number of results.
Since this is an unintended change in REST API behavior, it should be fixed in 4.1
The consequence of this is - its doing a full table scan, when it was optimized to not do it.