Dashboard is publicly accessible

Version: 4.9.2

If I provide a direct link to a Dashboard or a section of a dashboard to a friend, they can access the page without login whatsoever.

When navigating to the root domain, they see a login screen.

I found that the following setting “### When users are not logged in and visit Matomo, they should initially see” was set to “All websites dashboard”.

This is strange, as a login screen is shown when navigating to the root domain. Nonetheless, I changed it to “Show Login screen” and nothing really changed:

Direct links to dashboard can still be accessed without authentication, while the login screen is shown for root domain access.

I have been searching for possible bugs regarding this, but couldn’t find any.
I would appreciate it if someone could point me into the right direction.

Thanks in advance.