Am I correct in assuming that when you say your map service layers have different levels of access, you mean within arcgis.com? Specifically, you added a map service layer to "my content" then kept it as private. Then you added this layer to your web map, which is public.
The web map does not maintain the privacy setting of individual layers inside arcgis.com. The web map only stores the URL to the actual service, not the map service item inside arcgis.com. Thus, even though the item may be private, if the map service the item references is publicly available, it will show up in the web map.
One other detail is that the web map currently can't display map services that have security enabled on the service itself, outside of arcgis.com
Does this answer your question?
Thanks,
Mike