It’s a good question and a bad question at the same time. Why? Good, because the question sounds ‘exotic’ for many many Joomla users/superusers. Why this small line of code is there everywhere like the coca-cola of Joomla. :) 'Nobody' understands why it works that much.
defined('_JEXEC') or die('gooo to hell!');
The question is bad because in the Joomla documentation it is quite clearly explained what this line is, why it is there and when to use it and when not to. So the regular, knowledgeful users of Joomla stackexchange do not like to answer these kind of questions, since it takes a click to the official Joomla doc and someone just has to read it within 2 minutes. Why to copy it here? But, let’s just put the info here, really just for fun:
_JEXEC is a constant that is typically defined in the index.php file at the root of the Joomla! instance and is used to mark a secure entry point into Joomla. The defined or die check makes sure that _JEXEC has been defined in the pathway to get to the file
The general rule for the JEXEC check is if the PHP file depends on another file to operate properly. Typically if you access a file directly without the JEXEC check and a PHP error is raised (presuming your PHP error reporting is set to show errors by default) about a missing variable, function, object or similar then the file needs to be protected.
It’s quite clear explanation (copied from the doc) Based on the above:
I would not put jexec on the top of those files mentioned in the question.
Link to the doc: https://docs.joomla.org/JEXEC
It's not only an exotic question, but a good horror subject apparently with all kinds of nasty ghosts in it, anytime, anywhere. But what if this and what if that... Good question. :) So if a person is more like a paranoid type, then in any case it's better to include _jexec check on top of all files even without investigating the files and functions and understanding anything. That's for sure. (I’ll ask OSM to officially add these last missing sentences to their docs). ;
This was not part of the question but important:
If your extension is made for public and going to be distributed and used on many Joomla websites then it’s a must for using _jexec defined check on the top of all PHP files. It’s the ‘Better to be paranoid’ law.