Is USING SCOPE allPrivate a security issue for Private Reports?

Hi everyone, 

I found some unexpected behavior when querying the Report object using SOQL.

For example:

SELECT Id, Name, DeveloperName, FolderName,
       OwnerId, CreatedById, CreatedBy.Name,
       CreatedDate, LastModifiedById, LastModifiedBy.Name,
       LastModifiedDate
FROM Report
USING SCOPE allPrivate
WHERE Owner.Name = 'User B'

The user executing this query does not have access to User B's Private Reports. In the Salesforce Reports UI, User B's Private Reports are not visible to this user.

However, the SOQL query above is still able to return User B's Private Reports. 

Without USING SCOPE allPrivate, the following query does not return those records:

SELECT Id, Name, OwnerId
FROM Report
WHERE Owner.Name = 'User B'

My questions are:

1. Is this the expected behavior of USING SCOPE allPrivate?
2. Does allPrivate intentionally allow users to query metadata of other users' Private Reports?
3. Is this considered a permissions/sharing bypass, or is Report designed to behave differently from normal sObjects in this regard?

This seems particularly concerning because a user who cannot see another user's Private Reports in the UI can still discover their Report Id, Name, Owner, DeveloperName, etc. through SOQL.  

I'd appreciate any clarification or experience with this behavior. 

Thanks!