Security rules dont cascade like the docs said

Question

The security rules dont cascade, like the docs says.

This picture demonstrates the result of an authorized read request to path /foo/baz/bar/ done wi