Studio/ XS / UI5 security and SAP ABAP schema users

Hi everyone -

I was wondering what the thoughts were on SAP HANA native apps in a ABAP on HANA system.  It seems any user with a HANA Studio or a login URL for a XS engine or UI5 app can try to login with a SAP<SID> user and potentially lock the schema user, disabling the SAP ABAP system.

I've done a quick search but are there any standards for hardening the SAP schema users in such a scenario?  This would appear on the surface to be a potential issue.

Thanks!!