Yes, and if you're running a node and someone gets your admin macaroon they can drain funds.