A user not getting security violation even though the don't have a PERMIT for the resource.
If the resource is Permitted to the ALL records, all users will have access to the resource and not need a PERMIT to access the resource.
Issue a TSS LIST(ALL) to list the ALL record to confirm if the ALL record is PERMITed to the resource.