no no…

the issue is that if you install LNBits and not NOT set it up and have umbrel exposed on the public internet, then an attacker can do the setup and steal funds by extracting the LND macaroon.
roughly like that.

“public and not fully setup” is the important part here.