Triggers run in "system mode", where user permissions and sharing are not applied.
By delegating to Apex "with sharing" you can get the current user's sharing to be applied.
I am guessing that, so it doesn't matterbecause triggers are a bit "special", there may be some different handling of undeclared (and perhaps explicitly declared) inherited sharing, even when invoked indirectly. I don't know if the codeit is with/without/inherited - therea bug or simply won'tundocumented behaviour.
There is some possibly a little out-of-date detail in this other thread that may be any sharing constraintsof interest.