As pointed out, everything is compartmentalised. Do you have a specific security concern here or not? To repeat the reasons for this - regtest mode is not only for running regression tests (perhaps it should be renamed), but also useful for ad-hoc app development. In that situation it's very convenient to not have to mess around with RPC users or passwords. Because no real money is at stake, having RPC security is rather pointless.