question

The thing to bear in mind is that PlayFab is a Web API base service. So you can easily open Postman, for example, and make valid calls to your title - that's actually a very handy way to test. In your case, since the game hasn't been released yet, someone would need to find your Title ID somewhere, or guess it, in order to make any calls to the title. Looking at your previous posts, I see that your Title ID is in at least one, so that's probably the source.

In general, this isn't really a concern. If there's no incentive for someone to make calls on your title, it's unlikely they'll continue to do so. The things to bear in mind are:

1. Yes, you can make the Web API calls via generally-available tools, and as the client devices you're shipping to are general purpose computing devices, they're easily compromised. So anything you want to be secure in your game should really have server-side logic controlling it, either in Azure Functions Cloud Script or by using hosted custom game servers.

2. Before shipping your game, it's a good idea to profile all the API calls you're using and turn off all the ones you're not, using the API permissions policies. https://community.playfab.com/questions/33774/is-it-possible-that-a-player-updates-his-playfab-d.html