We noticed in Report Manager that users have all security strings when they do not have those assigned in OneClick.
Users with the "administrator" license in Spectrum will receive all security strings in SRM.
This is functioning by design.