Thank you for reporting this observation janecek.mato!
I’ve reported but not confirmed what you have found [Permissions] Check field level "read" permissions for "fields" in list / report queries · Issue #16388 · frappe/erpnext · GitHub
For further followup notice please subscribe to that.
This may be of interest Is there an ERPNext Security Officer? - #2 by revant_one
@rmehta @umair @revant_one please followup with this, my report assumes that it is critical.