Good question. It seems to me that the service can't be invoked from another computer unless there is a gateway. It might be invoked from another application running on the same app server if the InVM transport is enabled.
It is possible to invoke an esb aware endpoint (not a gateway) from anywhere as long as the client can see and connect to the registry. It should be possible to secire services like this by turning on security for the service. See the docs for this.