Currently the EventTransformer does not enforce authentication nor authorization. This was mostly, as the data-plane was written in nodejs.
With #8708 we got an auth-proxy which can be added as a sidecar and does the auth checks, before passing the request.
We should integrate this auth-proxy similar as we've done it for the IntegrationSink.