They may have changed it in recent versions, but for a long while, functions were public by default (i.e. anyone can call them). Defaulting to open is a huge security flaw and the reason behind the Parity bug https://blog.comae.io/the-280m-ethereums-bug-f28e5de43513