AMQ accept connectors even without user-password

Issue

• In the statefulset of my project I've explicitely configured an username and password for connecting to the broker BUT even if I comment in my code the values seems that I'm able to connect:

 <!-- configure the camel activemq component to use the current broker -->
    <bean id="activemq"
        class="org.apache.activemq.camel.component.ActiveMQComponent">
        <property name="connectionFactory">
            <bean class="org.apache.activemq.ActiveMQConnectionFactory">
                <property name="brokerURL"
                    value="failover:(tcp://broker-amq-headless.1510-amq-somedomain.svc:61616)" />
              <!--     <property name="userName" value="some_user" />
                <property name="password" value="some_pass" />    -->
            </bean>
        </property>
    </bean>

• Is there's a way to avoid this?
• How can I secure the cluster?