ApiLayoutController::componentInstanceExistInComponentData doesn't correctly traverse the tree, the check for empty slot data on line 504 prevents checking the current components in scope.
Load the data from layout-default.json
Call this method with the UUID eaa37ee1-7d50-4041-b04c-c80bdbac3412 - you should get content but instead get NULL
Postponed
1.0
Data model
This actually allows access bypass
Postponed on 📌 Replace the postPreview action with atomic equivalents Active which will fix this and add tests, but logging as a stable blocker so its not forgotten