“Any third-party library that will be referenced by the main project will be exposed if there is something inside which is called controller.”

Transcript evidence from Niels Tanis -- A Slice of the Razor with ASP.Net Core.