*Dangerous* Client Side Script Is Able to Post Transaction in Closed Period

I have a client side script that creates a bill credit automatically on a user click of a button on a custom form.

I've just discovered that this script is able to create transactions in closed period.  Surely this is NOT GOOD?

The relevant part of the script is:

var billcredit = nlapiCreateRecord('vendorcredit');
  
billcredit.setFieldValue('entity', partner);
billcredit.setFieldValue('custbody_loanpoonbillcredit', id);
billcredit.setFieldValue('trandate', startdate);
billcredit.setFieldValue('memo', 'Deposit for ' + name);
  
billcredit.setLineItemValue('expense', 'memo', 1, 'Deposit for ' + name);
billcredit.setLineItemValue('expense', 'taxcode', 1, 5);
billcredit.setLineItemValue('expense', 'department', 1, '1');
billcredit.setLineItemValue('expense', 'location', 1, location);
billcredit.setLineItemValue('expense', 'amount', 1, depositamount);