CCM LoadBalancer - K8s service type LoadBalancer isn't enforcing `Spec.loadBalancerSourceRanges`

I am unable to make the loadBalancerSourceRanges work as I expected with the LoadBalancer controller. I have the following service:

---
apiVersion: v1
kind: Service
metadata:
  name: echoserver
  annotations:
    oci.oraclecloud.com/load-balancer-type: "nlb"
    oci.oraclecloud.com/ingress-ip-mode: "proxy"
    oci-network-load-balancer.oraclecloud.com/security-list-management-mode: "Frontend"
spec:
  selector:
    app: echoserver
  loadBalancerSourceRanges:
  - 10.0.0.0/24
  ports:
    - port: 80
      targetPort: 8080
      protocol: TCP
      name: http
    - port: 443
      targetPort: 8443
      protocol: TCP
      name: https
  type: LoadBalancer 

As this is a public load balancer I expected that setting the source range to 10.0.0.0/24 would prevent me from accessing the service over the public Internet from my source IP, but it does not - I can still access my echo-server.

Start with the Service manifest and trace the LoadBalancer controller entry point that processes loadBalancerSourceRanges and the OCI annotations. Reproduce the public access behavior described here, then inspect the resulting security rules. Done means traffic outside 10.0.0.0/24 is blocked for the public load balancer.