It appears that Survey123 surveys that are downloaded on a device remain available to all users of that device regardless of which user account was signed in to download the survey. This is unlike with Collector, where offline maps are only accessible to the user who downloads them. So signing out on a shared device is not enough - any surveys they download must now be removed as well, or they can be used by whoever next uses the device.
I did a test where I downloaded a survey that was shared with my account. Then I signed out and had a colleague sign in with their account. The survey still remained accessible and that user was able to submit data successfully - even though they would not have been able to find and download the survey if it wasn't already present on the device because it was NOT shared with them. Additionally, if one user has some surveys saved in the Outbox, those saved surveys are also available for viewing, submission, or deletion by the other user.
Is this by design, or a bug with the app?
It seems to be a flaw to me, for a user to be able to use and submit data on a survey that was never shared with their user account. Not everyone uses a mobile device dedicated to them - at my company, we also have several shared tablets that get signed out for fieldwork, which means multiple users sign in and out. With Collector, it wasn't a problem. Simply sign out and any offline data from the previous user is inaccessible to the next user. With Survey123, that does not happen.
With the latest 3.10 version, we had improved the user log in experience and user permission checking. If the user does not have permission to the survey and logs in a shared device, they could see the previous surveys downloaded in the device but when they attempt to submit the survey, they will get a warning message with an insufficient permission to move on.
Could you try the 3.10 version of field app from our EAC site with your workflow to see if the new version addresses your concern?