Why sensitive information Webform information exposed with jsonapi and custom access check?

I'm on D9.3.x with Webform 6.1.4. Some sensitive information is exposed when adding a custom access check on webform submissions.

E.g. with no custom code, when GETting jsonapi/webform_submission/my_webform without right permissions the site returns:

    "jsonapi": {
        "version": "1.0",
        "meta": {
            "links": {
                "self": {
                    "href": "http://jsonapi.org/format/1.0/"
                }
            }
        }
    },
    "data": [],
    "meta": {
        "count": 0
    },
    "links": {
     [...]
    }
}

If I add a custom Webform handler with:

public function access(WebformSubmissionInterface $webform_submission, $operation, AccountInterface $account = NULL) {
    if($operation !== 'view' || $account === NULL) {
      return parent::access($webform_submission, $operation, $account);
    }

    $current_account = $this->entityTypeManager->getStorage('user')
      ->load($account->id());

    $webform_author = $webform_submission->getOwner();

    $webform_author_field= $webform_author->myfield->value;
    $current_account_field= $current_account->myfield->value;

    if($webform_author_field === $current_account_field) {
      return AccessResult::allowed();
    }

    return parent::access($webform_submission, $operation, $account);
  }

The same GET returns:

    "jsonapi": {
        "version": "1.0",
        "meta": {
            "links": {
                "self": {
                    "href": "http://jsonapi.org/format/1.0/"
                }
            }
        }
    },
    "data": [],
    "meta": {
        "count": 5,
        "omitted": {
            "detail": "Some resources have been omitted because of insufficient authorization.",
            "links": {
                "help": {
                    "href": "https://www.drupal.org/docs/8/modules/json-api/filtering#filters-access-control"
                },
                "item--5EzsKk7": {
                    "href": "https://mysite/jsonapi/webform_submission/my_webform/5815d421-9ba1-4c2f-a1d3-00233261658f",
                    "meta": {
                        "rel": "item",
                        "detail": "The current user is not allowed to GET the selected resource."
                    }
                },
                "item--hsvvR7z": {
                    "href": "https://mysite/jsonapi/webform_submission/my_webform/66b5ae7c-24b0-46cd-9b7e-2e78969eae17",
                    "meta": {
                        "rel": "item",
                        "detail": "The current user is not allowed to GET the selected resource."
                    }
                },
              [...]
            }
        }
    },
    "links": {
[...]
    }
}

Thus exposing both the total of the submissions and their uuid. Have you idea why it happens?

Edit: updated code and noticed one thing. If the site has some submissions but the user has 0 which he can access with the "base" webform settings, the GET returns 0 in the "meta". Aka the custom code has no effect.

However, if the user has some submissions he could access to with the "base" settings and the custom access() function run the `AccessResult::forbidden();' then the "meta" in the GET is populated with the submissions the user could have access to.