Forums Service Security

Seems like permissions don't work correctly when using the service url for the forums module.
I have one forum group called moderators that I set permissions to moderators only for everything. The page with the widget shows the forums correctly, moderators group is hidden for non moderators and they can see all forums that are public

However typing in the service url /Sitefinity/Services/ForumsService.svc/ will show all forum groups if your logged in as a moderator or not. :(

filterQueriesByViewPermissions is also set to true...

Do i not understand the way permissions work, shouldn't permissions applied to a forum item also be applied to the exposed json service?

What about other SF modules, images, docs, etc?