I have some doups about how control de msg.sender using web3.

For example I have this function in solidity: Where owner is the msg.sender used in costructor. for example is 0x9;

function NoPass() external view returns(string memory){
  require(msg.sender == owner, "NO ERES EL PROPIETARIO");
  return "HACKEADO";}

Then from JS I call this function like:

contract.methods.NoPass().call({from:"0x9"}).then(res=>{
     console.log(res);})

I can call this function and skip require because my call FROM i write the same account like owner. How Can i fix it? Because I save the account in a value then hacker can modifie this account value and skip requires.

Thanks, I'm new In Send functions wrks its just call functions but meh it is normal?