Hiding the button is not auth

A Next.js Server Action deleteProject(id) is only rendered on the admin page, so it has no permission check inside. Why is this unsafe?

'use server'
export async function deleteProject(id: string) {
  await db.project.delete({ where: { id } })
}