asterisk users - Sep 2005 - Weird SIP behavior or I need a shrink?

Am I reading the facts wrong or SIP will receive calls from unauthenticated
SIP user agents? The phones don't have to try to register. Of course
autocreatepeers=no. Is this behaviour by design? If the phone tries to
register than the attempt will be rejected, but the phone can still send
calls to Asterisk, and they will be processed. If that is the case, why do I
need to use SIP authentication for? It beats me. Anybody can still send
calls and I will have to judge the call on its caller ID, which anybody can
fake. Please help me understand where I am wrong, because I am sure that I
am missing something. Otherwise the whole Asterisk is insecure as a SIP
server.