Android: OnBootReceiver: Exported receiver does not require permission

I've created a BroadcastReceiver, which receives BOOT_COMPLETED.

In my AndroidManifest.xml I've added it like so:

<receiver
    android:name=".OnBootReceiver">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" /> 
        <action android:name="android.intent.action.QUICKBOOT_POWERON" />
    </intent-filter>
</receiver>

However, I get the warning: Exported receiver does not require permission. I've read about it on SO, but I don't fully understand it.

So could someone explain to this beginner :) why I'm getting this warning, and what to do against it (and why)?