limiting user defaults their posts to unlisted. unauthenticated access unchecked can view public timelines

[tylerzika]

I've setup my own server with the following setting:

and limited an account:

but you can still see their posts without logging in:

https://zika.social/@indie

It looks like if when you limit a user their posts default to unlisted and unauthenticated can view posts. What can I do?