Imo even for writing it isn't fine (except for what I mentioned) because the signature already proves who's the author of the event. Requiring auth for reading would be similar to what X/Reddit do when asking for money to access their closed apis, which goes against Nostr selling point. It may also be interpreted as the relay inability to stop spam by other frictionless means.