Some organizations have a physical location that needs to be open and accessible to the public for the organization to function, such as a clinic or a walk-in office, and some do not. Organizations that don’t need an accessible location can use a virtual office service to have a public address that doesn’t compromise their actual location. Some states also have address confidentiality programs to protect office addresses from publication requirements in the event of threats.
Publicly accessible physical locations are necessarily vulnerable to certain types of threat, including infiltration, malicious law enforcement reports, bomb threats, and right-wing protestors showing up in person.
Preventing infiltration, including by bad actors posing as volunteers, clients, donors, or patients, is not always possible. Still, operational security strategies such as careful screening and sharing information only on a need-to-know basis can mitigate the potential harms.
Remember that some right-wing organizations such as Project Veritas take video or audio recordings inside clinics and offices to release doctored content, and consider security protocols to make that more difficult.