Feature Service shows that it is share to organization but it is shared to everyone. My data is not secure. Portal indicates that it is secure.
This shows that my feature service is shared to the organization. When examining the REST endpoint, it is shared to everybody. This is a massive security flaw.
Perhaps "working as designed" per Esri's documentation might be a better way to put it.
I'm not disagreeing with you, because it's misleading and easy to misunderstand unless you read Esri's documentation to get an understanding of how it works. I believe others have been in this situation, which is why some ArcGIS Ideas that David linked above have already been submitted for Esri to improve this. If the map image and feature layer truly are dependent on each other, then I think it would make sense for the permissions to be "linked" to each other. Meaning that if you change permissions to one, it forces you to change permissions to the other (perhaps giving you a pop-up message stating that). Otherwise, as you've encountered, it's misleading when the permissions in Portal state one thing, but in practice, are actually something else.
