Related Entries to Users
If currentUser isn't defined, it returns null. So what's probably happening is you have people visiting the site who don't have user accounts or aren't signed in, which means the currentUser variable is set to null for them. So in your query you end up passing null to the authorId param, which means it will get everything (null being the default if I'm not mistaken). Most likely in your local environment you did all your testing while being signed in.

To solve, you'll want to surround your code in a conditional:

{% if currentUser %}
    {% set campaigns = craft.entries.section('campaigns').authorId(currentUser.id).all() %}
    {% set proposals = craft.entries.section('proposals').relatedTo(campaigns).all() %}
    {% set proposalsByGroup = proposals|group('proposalStatus') %}
{% else %}
    Please sign in to view your proposals...
{% endif %}