An app developer enables the " Allow access to this table via web services "...

Enabling “Allow access to this table via web services” allows authenticated users with proper roles to access this table via REST/SOAP APIs.

From Development Handbook 4.0.4, p. 191:

" This setting allows web service access to a table, but still requires that users have appropriate roles and permissions through ACLs. "

Thus, access isn’t automatic — proper access controls still apply.