The default SharePoint security applies to the Server extension. Like any web service, it is executed by an authorized user in ShareGate Desktop, so you require the appropriate rights or security credentials to do any kind of modification.
The Server extension allows ShareGate Desktop to perform operations that are available in SharePoint, but is not exposed in public interfaces.
The Server extension does not allow users to perform any operations that they would not be otherwise authorized to perform.