Users are able to access records in a territory that they are not a member of

Users are able to access records in a territory that they are not a member of

Hello,

I have several territories set up in our CRM. I recently ran a test to see whether users that are not members of a particular territory can access records within that territory (e.g. Accounts, Contacts, Deals), and it turns out that the users that I tested this with can still access those records, despite not being members of that territory.

Why are users still able to access these records? How can I be sure that territory management rules are working as expected?