Depends on the context. JWTs are very often used as a type of session token. So if your token is public, it might allow someone to act on your behalf for whatev

Depends on the context. JWTs are very often used as a type of session token. So if your token is public, it might allow someone to act on your behalf for whatever service you're using. So while users are allowed to read the token and its contents, you don't want user-identifying tokens to fall in the hands of someone else. You might be thinking of a public key.