That’s what I understood too - but your file acces video (https://www.youtube.com/watch?v=F0nvORx4oVs) - is doing otherwise.
You did DENY for ‘AuthenticatedUser’ (and GRANT to particular user) - but you were still able to access file - anyways, its not of immediate importance.
Thanks.