@ericbirdsall yes, people could do it if they could find the URL and pass the correct arguments. With an external suitelet you can use a command line tool like

cURL

or Postman to directly create an invoice. Not sure if anyone could ever find the external suitelet buts its not secure.