My admin page is just hidden from the menu, is that protection?

Hiding a link is decoration, not security. And a redirect in the page component runs after the data is already fetched, in the user's own browser. Your instinct is correct: the data still loads, check the Network tab.

In a Lovable app (React + Supabase, no server of its own) the real lock is RLS on the tables. The page can do whatever it wants; the database must refuse to return other people's orders.

-- admins table only you can write to
create table admins (user_id uuid primary key references auth.users);
alter table admins enable row level security;

create policy "admins read all orders" on orders for select
using (exists (select 1 from admins where user_id = auth.uid()));

create policy "users read own orders" on orders for select
using (user_id = auth.uid());

Then the /admin page for a normal user shows only their own orders or nothing. Keep the redirect for nicer UX.