Comment by chimera77

Your Cloud SQL instance would have a public IP, but would not be exposed to the internet. All traffic is blocked by default. Only GCP service accounts with the right permissions can make connections to your SQL instance, or IPs added to a whitelist (not recommended).