Correct. If you make something outside of a local network, you have to place it inside a VPN for now. Otherwise, everyone will know you have access to it. OR, you can use NIP-42 to authenticate with your public keys to write and read from the relay.