This sounds another thing too. Are you able to find the 0x8ee73d traversing other nodes?
And yes, both in GraphQL and DQL, a user with free access will be able to explore other nodes. To mitigate this you must use Auth directive and set up permissions. Or don’t give free access to your GraphQL perhaps. But auth is free, you can set up an authentication provider with it.