Is it possible for bad actors to use unlisted payment methods returned by payment function?

[BotNot]

Good day, we want to build a app to enhance the checkout experience.

The question is:
If our payment function will return only one payment option, is it still possible for bad actors to pay for the order using another payment option that they know exist in our shop but not listed in our response ?

Thanks in advance!