Based on your question, you added subnets under a Vnet, then Azure routes network traffic between all subnets in a virtual network, by default. So by default, the subnets are exposed to the public depends on whether you assigned public IP to it.
Hope this helps
If you added a public IP address to the subnet, It allows public IP address. as per the screenshot, you already assigned a public IP and it means, it can be accessed from internet. So to apply restrictions you must add NSG, otherwise your subnet is public.