You can now use access control on Metafield definitions.
You can make the metafield’s storefront access as “PUBLIC_READ”. You can then access it in theme app extensions by expanding the namespace to - app--<app_id>
However, this is only available in the unstable version of Graphql API.
https://shopify.dev/docs/api/admin-graphql/unstable/objects/MetafieldAccess