Is below function can be called by a hacker after deploy
constructor() public
{
test = true;
}
No. A constructor
is special.
It is executed on deployment but the bytecode isn't deployed to the contract address, so it can't be run again.
Hope it helps.