See this on github

Plugins specify permissions: https://github.com/ssb-js/secret-stack/blob/main/PLUGINS.md#pluginpermissions-object-optional

To make a method public, it should be included in the anonymous array in the permissions object.

e.g. the example in the above linked file makes a localPeers method public:

  permissions: {
    anonymous: [ 'localPeers' ]                                         
  },

createHistoryStream has it specified here: https://github.com/ssbc/ssb-db/blob/master/index.js#L50

anonymous is the permission group that all remote callers are in by default. The local user and ssb-master-authenticated callers can call any method by default.