If I need to add custom fields only to user profiles, is it better to create a module that uses the field API, or a module that uses its own code to show the custom fields at a custom URL and to save the data in its own database table?
The field API doesn't implement the permissions necessary to decide which fields are visible to which users, if that is a reason enough to implement custom code.