Update…
For me, I struggle to see how it can be classified as expected behaviour if a privacy rule updates in real time with one constraint, but not with another constraint… and works on front end, but not on backend. Pretty obvious that it’s a bug. Unfortunate, but that’s the response and it’s here to try.
For anyone that stumbles across this thread in future, the bug is at least sometimes caused by privacy rules that references Current User’s X List of Y contains This Y. There may be other constraint structures that cause it.
Changing it so it’s Current User’s X is This Y’s X means it works fine.