Actions/Workflow security consideration - PR `on pull_request` workflows

I am suspecting some potential security implications via Actions/Workflows and wondered about opening conversations around it.

There has recently been a Workflow added from a permissioned contributor from a submitted PR, in this case @elreydetoda in PR #353 :

Note the `Building Prod Container` Workflow, which exists in #353 in [this file](https://github.com/JupiterBroadcasting/jupiterbroadcasting.com/pull/353/files#diff-c3d53273f274f7cd99d5ef9a6f7bdcb27fb62a67f6d62700bef49b0a9dde420a)

And here, being run automagically, or as requested:

This likely due to the newly-added `on pull_request` via #385, and that @elreydetoda has some repo permissions, otherwise a first-time outside contributor would produce this message:

(this is the view of the PR for contributor w write permissions)

This got me thinking about how GH Actions is running PR-submitted Workflows, despite not necessarily having been approved by any other repo contributor/admin. A potential security issue?

A worthwhile read that I believe pertains to our exact situation:
https://stackoverflow.com/questions/64553739/how-to-prevent-github-actions-workflow-being-triggered-by-a-forked-repository-ev

> GitHub still recommends that you do not use self-hosted runners with public repositories. They specifically state [self-hosted runners should almost never be used for public repositories on Github](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners)

* [GitHub Docs - Hardening for self-hosted runners](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners)

Looking for input!
Is my concern reasonable? Am I missing something? Is there a better way?