Entity query on custom entity is not checking access rights
You will need to implement hook_query_ENTITY_TYPE_access_alter  ( hook_query_project_member_access_alter) to apply the custom query access check.
For example https://api.drupal.org/api/drupal/core%21modules%21node%21node.module/function/node_query_node_access_alter/8.9.x
You might need to $query-&gt;addTag(‘project_member_access’) but from memory that tag may now be added automatically by the entity query handler.