PMA accessibility

Good day everyone,
I was just stalling through the server and realized today that phpmyadmin is accessible not only from the regular -, but even from ip address - and website as well - site.tld/pma. So all this time I kept thinking such option is specifically turned off in hestia? Am I wrong, or am I just missing something?

Appreciate your suggestions