It should be, but seeing is believing, and in well built apps with plenty of reuseable elements, it’s not always straightforward to identify what you have put on a page,
In the same way, ‘assume privacy rules are the only thing you protect your data’ is correct - it doesn’t mean people know what data is public and believe that it is public.