When media images are requested, Dianoga automatically runs mozjpeg, PNGOptimizer, nQuant, or SVGO on the image data immediately after it is placed in the Sitecore media cache.
Dianoga ensures that your site is always serving fully optimised media library images even if you are using Sitecore's dynamic resizing features (for example with Adaptive Images). Even if you have already optimized every image uploaded into the media library, after Sitecore performs image processing the result is not optimized (an unfortunate limitation of most other image optimization libraries for Sitecore is that they only apply to the original image).
In short; Dianoga will optimise all versions of your image. It does not touch the Media Library items at all, it operates purely on images served by Sitecore - these are all placed in the Media Cache.
No. Outside callers to the website would not be able to execute these - and if there is a security gap here, it would be present whether or not you had Dianoga installed.
Sure. But also check logfiles, Dianoga logs extensively. Be aware that you will see NO effect from Dianoga, if your Media Cache is already populated.
More information here: Dianoga