We have a number of hosted view layers on ArcGIS Online that were created to only include filtered versions of their source datasets. In some cases these filters were applied to better manage the data, and in others, we use a view layer because we do not want the user to have access to all of the records in the source hosted feature layer for privacy reasons.
However, we've discovered that when we use the Export Data > Export to CSV File option on a hosted view layer, all of the records are included in the resulting CSV, not just the records that are included in the view. This behavior is not at all what I would have expected, and puts us at risk of making records available to users who should not have access.
Is this by design? I would have expected an export from a hosted view to only include the records and attributes defined by the view.