Mastodon may expose followers-only posts to public. Is it a feature or a bug?

For example, this reply is addressed to the followers collection (to) and the mentioned user (cc):

https://not-brain.d.on-t.work/notes/admrkcvj3hfn5crj

But Mastodon says the reply is "public". Anyone can view it:

https://neuromatch.social/@kopper@not-brain.d.on-t.work/115343438096255204

#Iceshrimp also doesn't require authorization, but you need to know the post ID to view it.

@kopper Did you know about this?