How is ERC20Burnable securing that not everybody can burn tokens?

Support Contracts
2

Hi @oxuw4

ERC20Burnable burnFrom calls ERC20 internal function _burnFrom

    /**
     * @dev See `ERC20._burnFrom`.
     */
    function burnFrom(address account, uint256 amount) public {
        _burnFrom(account, amount);
    }

_burnFrom can only burn an amount of tokens if the caller (msg.sender) has an allowance previously set by the token holder.

    /**
     * @dev Destoys `amount` tokens from `account`.`amount` is then deducted
     * from the caller's allowance.
     *
     * See `_burn` and `_approve`.
     */
    function _burnFrom(address account, uint256 amount) internal {
        _burn(account, amount);
        _approve(account, msg.sender, _allowances[account][msg.sender].sub(amount));
    }

If the caller doesn't have an allowance or the amount isn't within the allowance (allowance set by the token holder), then attempting to decrease the allowance will fail
SafeMath sub with a revert with reason “SafeMath: subtraction overflow”

    /**
     * @dev Returns the subtraction of two unsigned integers, reverting on
     * overflow (when the result is negative).
     *
     * Counterpart to Solidity's `-` operator.
     *
     * Requirements:
     * - Subtraction cannot overflow.
     */
    function sub(uint256 a, uint256 b) internal pure returns (uint256) {
        require(b <= a, "SafeMath: subtraction overflow");
        uint256 c = a - b;

        return c;
    }

Let me know if you need more information.

This is similar to a question regarding transferFrom and allowances, which could be worth having a read of too.