We ship up a big JSON object of all the site settings that have client: true to all users, so those are considered public and viewable.
If they don’t have client: true then they are meant to be available from the server side. The admin section is an exception - we need to return all site settings to admin users so they can be changed! It uses a different API to get them all.