Realtime Events Triggered for Users Without Read Permissions

Realtime events are being received by users who don’t have read permissions on a newly created document.

Here’s the setup:

1. A document is created in the profiles collection via a Function.
2. The document is assigned read permissions only for userA and userB.

Permission.read(Role.user('userA')), Permission.read(Role.user('userB')),

But the issue is:
userC (who has no permissions) receives the documents.create event through the Realtime subscription.

Is this expected behavior for Appwrite Realtime? Shouldn't permission filters be enforced for realtime events as well?

@Steven @D5