Why, if I use the authentication by user / password (Publisher) can I see the data sent in another BROKER without authentication?

629/5000
Hello friends, I am implementing a project that uses user / password authentication. The publisher is thus:
self.client_mqtt = MQTTClient (self.CLIENT_ID, BROKER, PORT, NAME, MQTT_PASS)

On the other hand the BROKER is running mosquitto, this works well. But I've done tests with another BROKER on my PC and another client on my PC with: mosquitto_sub -d -t / #
The problem is that the PC client and the PC BROKER shows the data.

Why, if I use the authentication by user / password (Publisher) can I see the data sent in another BROKER without authentication?
I am doing something wrong?

Micropython: 1.9.3 with ESP8266

Non viene indicato alcun file sorgente né alcun test. Inizia riproducendo la configurazione con MicroPython 1.9.3, MQTTClient, Mosquitto e mosquitto_sub -d -t /, quindi esamina la configurazione della connessione e del broker per stabilire come il secondo broker riceve i dati. Il lavoro è completato quando il comportamento è spiegato e qualsiasi modifica concreta al codice o alla configurazione è chiaramente circoscritta.