Do we really need to Server Restrict every single Server Action we want to protect?

Do we really need to apply server restrict to each server action we want to protect? e.g.: /admin/user/delete

Wouldn’t it be better to just apply the server restrict to a group of routes? e.g. /admin

Am I missing something? It feels like Wappler didn’t nail this right yet. In other frameworks we have middlewares, so we can apply common logic to a group of routes instead of manually going to every possible page/server action we want to protect

Manually protecting every single Server Action is error-prone. Did you really protect every single Server Action?