Are "dummy URLs" required to make function calls to Flask from the front-end?
As others mentioned, you can secure the endpoint so that a user has to provide credentials to issue a successful request to that endpoint.
In addition, your endpoint should be using proper HTTP semantics if its creating / updating data.  i.e. POST to create a drink, PUT to update a drink.  This will also protect you from someone just putting the URL into a browser since that is a GET request.
TL;DR

Secure the endpoint (if possible)
Add checks that the proper request body is provided 
Use proper HTTP semantics
I am making my first web app with Flask wherein a database of drinks is displayed on the front-end based on selected ingredients. Then the user selects a drink and an in-page pop-up appears with some drink info and a button "make", when the user hits "make" it calls some python code on the back end (Flask) to control GPIO on my raspberry pi to control some pumps.
Does this "make" need to call some route (e.g. /make/<drink>) in order to call the python function on the back end? I don't like the idea that any user could just enter the URL (example.com/make/<drink>) where  is something in the database to force the machine to make the drink even if the proper ingredients are not loaded. Even if I did checking on the back end to ensure the user had selected ingredients were loaded, I want the user to have to user the interface instead of just entering URLs.
Is there a way so that the make button calls the python code without using a "dummy URL" for routing the button to the server?