Whenever possible, you should always limit your scope when programming. If one part of your code doesn't need access to another part of your code, it shouldn't be given access. This is popularly referred to as the
principle of least privilege.
So you would be correct in defaulting your functions to use private/internal modifiers.
However, I would caution you on assuming that your contract is secure because you limit who can call what functions.
If you send funds before decrementing a balance or rely on sending messages for control flow, you're still vulnerable to attacks.
Restricting scope by default is good practice, but restricting scope alone will not prevent attacks that leverage poor order of operations or re-entrancy attacks.