Security and sharing for apex class

Question

I created a profile with no special privilege like author apex(which is a combination of modify all data and view and setup configuration)given to it. The visualforce page is made accessible to the user of this profile using profile setting,controller is a with sharing class and it is made inaccessible to this user using apex class security.
Now this class has getGo() which returns string "inside go.." Call to this method is made using {!go} inside vf page.
Now when I login with the username of the stated profile and view this vf page I am able to see the output "inside go...." which according to me should not be the case as the class does not allow this user to access it.

Also referring to this link When to add apex class permissions to a profile it is stated here by user sfdcfox that - "The controller is also invoked through a Visualforce context, so long as the page has permission, any of that classes functions which are accessed by actionFunction calls, actionPoller calls, or even @RemoteAction annotations, are also granted access"
So does this statement mean that - if a user has access to the visualforce page then user can call any method of the controller class for which the user does not have access to! I think I am missing some major concept here.
Thanks in advance !

Answer 1

"With Sharing" only controls whether sharing rules are fired, not other security settings.

And if a user has "Author Apex" permission, they can access all Apex classes in the organization.

Make sure you thoroughly read and understand the various security documents like the couple I've linked to, as many of these platform features don't necessarily behave in the manner you may assume at first glance.