This comment is fine. It is saying that the function doesn't do any auth check but it shouldn't be used without doing an auth check.