Yes, I'm aware of the packages, `insecure` and `autopublish`. Once you remove these, you end up writing RPC methods (for the most part). This is a good thing.
From meteor's docs @ http://docs.meteor.com/#dataandsecurity:
Data and security
Meteor makes writing distributed client code as simple as talking to a local database. It's a clean, simple, and secure approach that obviates the need to implement individual RPC endpoints, manually cache data on the client to avoid slow roundtrips to the server, and carefully orchestrate invalidation messages to every client as data changes.
So, meteor helps you write RPCs, imo. Just like most frameworks do.