Server Functions don't expose ability to query DB from the client (unless that is specifically what you're trying to do). You can think of them as "syntax for endpoints". They don't change which code runs where.

They still execute on the server. Server and client code is never mixed in the same file, and there is a way to enforce at the build time that code destined for the server never accidentally gets pulled into the client bundles either.

See here for an overview. https://overreacted.io/what-does-use-client-do/#use-server