Public properties are automatically synchronized to the frontend over the persistent websocket connection we made - which means CPU load on the gateway and client will be raised, memory usage on the client to hold that data, and more traffic over the network. Meanwhile, literally nothing on the frontend can actually interact with those properties outside of module-added components or the aforementioned markdown-component JS injection hack.
I don't know the exact reason we didn't make all custom properties private automatically; perhaps optimism at the time about what offline mode would become and how it could make use of them, but at this point in time it's pretty indefensible.
While some actions do run "locally" - none of the ones that do have any way to interact with custom properties specifically.