Auth result is never evaluated

`await supabase.auth.getUser()` protects nothing. The call returns a value; only what you do with that value is the access check. Without the `if (!user) throw`, the function runs for anonymous callers exactly as it does for signed-in ones.

This is precisely what code generators produce reliably: the "load the user" pattern visibly belongs to the style of secure server functions, but the consequence is not a pattern, it is a decision — and the model does not make it. A review that searches for `getUser` finds the call and ticks the box.

Check it yourself: find every `getUser`, `getSession` or `auth()` call and read the next five lines. If there is no bail-out and the user value does not appear in the written data either, the check is decoration.