Am I wearing a tin foil hat or is a public facing print server an issue?

My corporation uses a publicly facing print server to handle requests coming in from users to place orders from our website.

This seems upside down to me as I would imagine that once validated on the site that the user would place the order request and the web application would then place the local print request, allowing it to be restricted to a singular known IP.
My organization is telling me I'm being overly paranoid and that it is secured …

cybersecurity foil print public server