An app developer enables the "Allow access to this table via web services" option in...

Enabling “Allow access to this table via web services” allows authenticated users with proper roles to access this table via REST/SOAP APIs.

From Development Handbook 4.0.4, p. 191:

"This setting allows web service access to a table, but still requires that users have appropriate roles and permissions through ACLs."

Thus, access isn’t automatic — proper access controls still apply.