In fairness, this is only the case when people are actually inspecting the code. That safe could be a cake that looks like a safe, but if nobody tastes it there is no real benefit (in terms of security at least)
Yes, but people can still browse content from your instance without logging in. There is nothing stopping people from viewing illegal material through your instance.