Although a public IP address is required, you don't need to poke any holes in the firewall. As a result, it is not a problem from a security perspective.

https://cloud.google.com/sql/docs/mysql/connect-run