Comment by miguelspizza

Not sure I understand. The model has no more access than the user does. proper security implementation still lies with the website owner