Why def get_pdf_link not white listed?

when i tried to get doctype print pdf through scan QR code it didnt work and needs permission
it worked only when i add guest permission read for the doctype

although in another servers it worked without permission

when i did some search, i found this function not whitelisted? nor allow guest true??

any explanation

def get_pdf_link(doctype, docname, print_format=“Standard”, no_letterhead=0):
return f"/api/method/frappe.utils.print_format.download_pdf?doctype={doctype}&name={docname}&format={print_format}&no_letterhead={no_letterhead}"