Most dapps require an instance of web3 provider in the browser. It seems that it is often achieved by directly connecting to Infura or Alchemy node URL (for example, in WalletConnect docs: https://docs.walletconnect.org/quick-start/dapps/web3-provider).
Infura and Alchemy charge for the node usage, so it seems a bit insecure to just embed node URL directly in the webapp code - anybody can extract the url (with the key) from the code and then use it for his own projects (or just make the dapp owner suffer by raking up huge fees for node usage).
Am I misunderstanding something? What is the common approach for dealing with this situation?