Access check only on the top field

In GraphQL, the order(id) resolver checks ownership, but the user(id) { orders { ... } } path returns any user's orders without a check. What is the lesson?