The key thing to understand with PowerApps is that the actual security of the data always lies in the data source rather than within the app itself. The ability of users to access data from various sources will depend on the connection that is established with the data source. PowerApps is purely designed to be a user-facing interface to access the data source, and therefore does not, by default, have any perception of the user and the rights they may have.
SQL Server, as an example, will use a username and password to authenticate and establish a connection with the data source. Any users using the app will automatically be able to access the data using the credentials that are stored within the connection.
Other data sources, such as SharePoint, require both the app creator and any subsequent users of the app to have explicit access to the underlying data source. So, for example, if your app user only has read access to a SharePoint list, yet your app allows them...