Wondering what is the general rule for security in each server action (e.g. just security provider, or both SP + SR)?

Ok
Personally, I would be putting a security restrict on pretty much every server connect file.

I mean I guess you just ask yourself, would you want someone to be able to access the output of the server connect file (whatever it is) without being logged in?