node_load_multiple does not respect node access grants
You can do it like this. First, query the NIDs, with a query that is tagged for node access, then load the nodes with the found NIDs.

$nids = db_select('node_field_data', 'n')
  -&gt;fields('n', ['nid'])
  -&gt;condition('title', $my_title)
  // The node_access tag will check access rights.
  -&gt;addTag('node_access')
  -&gt;execute()
  -&gt;fetchCol();

$nodes = Node::loadMultiple($nids);


Untested in D8, but it should work.