I can provide a bit of insights:
DataHub services by default would be able to be accessed by anyone who has access to the docker / kubernetes pods on the network. Using K8s (or cloud provider security policies), you can control which ports on each pod are exposed to the outside world using proxies. The key services by default will appear on localhost:9002, localhost:8080, localhost:9092, localhost:3306, ... and a few others on the local machine where DataHub is deployed.
If you are not publicly exposing the ports where datahub runs (e.g. localhost:8080) outside of the node where datahub is deployed, there is no security concern. But when you deploy it is expected you understand how to properly set up security rules to prevent unauthorized access to the internal datahub services by only surfacing officially public endpoints (localhost:9002 where the datahub frontend service is served).
If you only intend to expose DataHub to your organization (e.g. on a private network not accessible from the internet), you should generally be A.O.K. The disclaimers noted are primarily to serve as a warning to closely consider security implications before making DataHub "production', reminding you to closely consider how traffic accesses your DataHub instance where ever it is hosted