OpenClaw's userbase is very broad. A lot of people set it up so only they can interact with it via a messenger and they don't give it access to things with their private credentials.
There are a lot of people going full YOLO and giving it access to everything, though. That's not a good idea.
What use is an agent that doesn’t have access to any sensitive information (e.g. source code)? Aside from circus tricks.