Make MySQL database accessed by just one user
You need an 'admin' for maintenance, etc.  You don't have to call it 'root' and you don't have to let everyone know the password.

It is 'best practice' to grant user(s) access to one (maybe more) database(s).  In this context, a "user" could be a human, or the login for an app.  Example:

 GRANT ALL PRIVILEGES ON dbname.* TO username@"1.2.3.4" IDENTIFIED BY "...";


That implicitly does not give that user (from that host) access to any other databases, nor privileges such as CREATE DATABASE or GRANT.

When writing Stored Routines, carefully think about the use of SECURITY INVOKER versus SECURITY DEFINER.  INVOKER means that the routine cannot do more than what the user could manually do.  DEFINER lets the routine be more powerful.  This can be useful for providing some otherwise-restricted operation to mere users.

(Caveat:  Newer versions of MySQL have "Plugins" and "Roles" that are more involved than the old GRANT; these let you have more involved security models.)