_isDefined not respecting Who Can Read?

Summary: I created a Thing (with model Root Model, a bare-bones model), then went to the Thing's Sharing page and set every single permission to "Owner", including "Who Can Read". On another account, when I use the Name of that Thing in QL, I get the expected "there is no thing with that name" error... but if I test _isDefined on that same name, it yields True.

Hmm. Definitely a security bug, although not quite severe enough for me to mark it as Critical.