aapit

I understand very well that it’s logical from a technical perspective, if you just block pretty much every url.

However, from a functional / workflow / usability perspective, there is a good reason that logged in users can still see the full site, even though the general public sees a Coming Soon message.
Orders not coming through are not desirable when you want to test out a webshop behind the scenes, being a logged in user. That’s not at all an exotic scenario, in fact it’s quite silly to me if one would just put the site live and expect the shop part to work out of the box (even if you’ve tested it on another url).
Also it’s something you could prevent – for instance by not blocking the callback urls with the plugin.