Yes, this is why SQL plugin should be used with caution, only for internal app where every user can be trusted.
We developed this plugin for specific enterprise needs, building self hosted internal apps. Its not secure to expose such app on internet.