Yes you are right. Source ref for anyone interested - https://github.com/simonw/sqlite-utils-ask/blob/91277eeb26bd...

There are also some SQL parsing libraries for python that you can use to restrict things further. But opening the DB in RO mode is a good start.

Another concern with tools like this is query performance and not accidentally overloading your database with some stupidly expensive query.