The server actions are not restricted by default. There are many cases where the data need to be displayed on the front end and doesn’t need any protection.
It’s up to you to restrict the server actions, which are supposed to be used in your admin panel / cms etc. and the ones that are not supposed to serve publicly available data.