In this case we don't have a choice as it's the OpenSearch standard : http://www.opensearch.org/Specifications/OpenSearch/Extensions/Suggestions

It's only a security problem if we return sensitive, private data, since that could then leak and be accessed by a malicious website an user is visiting using the trick you describe. AFAIK here we don't do any kind of filtering (such as reviewers only stuff that happens in another class) so we're good.