I am interested in this more from a security standpoint. If I had a dangerous server action that I only had a use on the server for example:

"use server"
export async function deleteUser(userId: string) {
  await db.from(Users).delete(userId)
}

Could it be somehow accessible from the outside like an API call for example?

In the function that user interacts with I would have auth checking with another primitive function validateRequest like this:

"use server"
import { validateRequest } from "auth-actions"
import { deleteUser, deleteUserPosts } from "user-actions"

export async function banUser(session: Session, userId: string) {
  const isAuthenticated = await validateRequest(session)

  if (!isAuthenticated) return

  await deleteUser(userId)
  await deleteUserPosts(userId)
}

If deleteUser was an API route it would be unsafe since anyone could POST a userId and delete a user, so I am wondering if it is the same with server actions?