The "public" dialplan context contains extensions that can be safely reached by calls that are incoming from the wild external world and by non authenticated users. Those extensions do not give access to costly services (eg, outbound calls) or to exploitable features.

The "public" context is the one servicing inbound calls from DID numbers, sent to us by ITSPs. Also, this same "public" context is servicing whatever call comes from non-authenticated users.

It has very few features and extensions, just enough to connect an inbound call to one of our registered internal phones, or to services like voicemail and IVRs.
And it usually provides those features and services by "transferring" in an absolute and final way the call to an extension in the "default" dialplan context. We saw before how we set the call incoming from DID number to be "trasferred" to the "1012" extension in the "default" context of the "XML" dialplan (dialplan is always "XML" in example demo configuration). No way to go around, "transfer" is going to an absolute extension.

The "default" dialplan is where in example configuration most of the action is, and is servicing authenticated internal users. When a phone connects to the "internal" SIP profile and register itself, it is challenged to provide username and password. Those are checked against the User Directory. If the user is authenticated, it is then associated to all variables and parameters contained in its User Directory user definition, and in the groups and the domain it belongs to.

Amid those variables and parameters associated to an authenticated user in demo example configuration, we find the variable "user_context". That variable is set to "default". THAT'S IT!!!

So, an internal phone registers itself as a user, has its credentials checked against the User Directory, is successfully authenticated. If that user has a variable "user_context" defined in the User Directory, then all calls originated by that user (phone) will be routed by that defined dialplan context (overriding the context set in SIP profile).