Just after installing ezplatform is perfectly possible to access urls like
http://localhost/create/nodraft/folder/eng-GB/2

This allows you to see the form with the fields related to that content type. If you try to publish then you get a permission problem, but i'd expect to have this restriction also for this create/nodraft module.

If this is not made in purpouse, i'd say we should protect that and only give access to users with the proper permissions