Technically, all posts are public by design. This “sign-in required” is just a flag on the post asking clients “please don’t show me to everyone,” and app developers could ignore it.