Postgres' guidelines on `SECURITY DEFINER` functions mention that it's desirable to revoke `EXECUTE` from `PUBLIC` from them: https://www.postgresql.org/docs/current/sql-createfunction.html#SQL-CREATEFUNCTION-SECURITY