It's just code - NWC could have a safe way to generate a public connection string that can only make invoices, and clients could use this instead of an LNURL address