How to secure custom endpoint for rest api in WordPress

Add permission_callback parameter and set it to whatever authentication you want to apply.

So, if you want to make it accessible to a user having manage_options capability, your code should be something like this-

add_action('rest_api_init', function(){
    register_rest_route('fs/v1', 'posts', [
        'methods'             => 'GET',
        'callback'            => 'fs_posts',
        'permission_callback' => function( $request ) {
            return current_user_can( 'manage_options' );
        }
    ]);
});

If it’s for any logged-in users, for example, use this-

add_action('rest_api_init', function(){
    register_rest_route('fs/v1', 'posts', [
        'methods'             => 'GET',
        'callback'            => 'fs_posts',
        'permission_callback' => function( $request ) {
            return is_user_logged_in();
        }
    ]);
});