If public open is the default (I'm going to give benefit of the doubt and assume it is not) then that is very bad design and would make me question if I trust the devs much at all.

But yes, never set media hosting to open upload unless you want to become an image host for content people can't host elsewhere (or just for images used in spam campaigns).