Yes, it's a bit of a flaw that is fixed by Atlassian adding a default "must have a generic transition-issue permission" explicit in the permission schemes - but you'll need JIRA 6.2 or above, if I remember right.
Otherwise, no, there's no protection, and anyone can use a transition unless you put at least one "condition" on it. I'm afraid you need to edit all your workflows and add conditions (even if it's just "is a JIRA user", I'd recommend putting a condition on every transition every time)
Badges are a great way to show off community activity, whether you’re a newbie or a Champion.Learn more
Hi Atlassian Community! My name is Shana, and I’m on the Jira Software team. One of the many reasons this Community exists is to connect you to others on similar product journeys or with comparabl...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs