Yes, credentials to receive must be shared so people can send you money.

Credentials to spend must be kept private so people cannot steal your money.

NWC does make this distinction very hard, because all NWC strings look the same, so the user is understandably very confused. And some apps (like Coinos) do not even allow to remove permissions from them.