Update WITHOUT select permissions returning ALL data in row

[manurana]

Lets take 2 tables

event
- id
- host_id
- ...

event_attendees
- id
- event_id
- user_id
- token
- muted
- ...

Assume a simple FK relation between event and event_attendees

Permissions

1. Attendees can only see rows in event_attendee that are theirs. All fields
2. Attendees can update event_attendee.muted for their own rows
3. Event hosts CANNOT see ANY row in event_attendee
4. Event hosts can update event_attendee.muted for events for which they are host.

See below screenshots for the setup

Issue

If I do a query as a host, I cannot see any row in event_attendees, which is correct
But if I do an update as a host, I can see all the data for the updated row !
Is this by design ? Does not make sense logically

Screenshots of permissions on event_attendee