Contribution activities shown to users without permission

If you don't give a (drupal) role any of the Civiconrtibute permissions or permission to view or delete activities, contribution activities can still be searched for and found. Although those activities are properly hidden when the activity tab is viewed for the contact that made the contribution.

This is a major security problem, as it allows seemingly anybody with Civi access to see all contributions, who made them, and how much they were for.