Confirmation of how plugin router authentication/policies work

Questions and Answers Strapi Backend
2

Yes plugin routes will let anyone who is authenticated in unless you add permissions