Yes, once your app is in the cloud it is accessible to anyone who knows the URL and has login credentials (or if you decide to allow anonymous users then anyone who knows the URL).
A free app is ‘published’ to the mendix cloud if you choose the “run” option from your modeller rather than run locally. After it finished running to the cloudl (should take about 5 minutes or so) you can click the view to be taken to the URL of your free sandbox app. Licenced apps can be published to other clouds but by default it should be on mendixcloud.com.
I've found that the free app can be used to demonstrate most functionality but has limitations in testing since it allows a maximum of only 10 users.
If using a free app, you should be aware of the fact that scheduled events are not working. Also pubplished webservices may not be available, since the app is sleeping if not in use.
Yes, if you publish the app as a free app, then everyone on the internet could have access to it. You should think about to set the security settings on your app to productive, to make sure only users with username and password are able to connect. This should also save you time by setting the security settings directly on the begin of the app.
You should keep in mind, that it isn’t possible to switch off the app. After some hours, the app supends to sleep mode, but will restarted, whenever a user calls the link. The only way to stop the app is to delete your project.