As explained in the documentation:
Apex generally runs in system context; that is, the current user's
permissions, field-level security, and sharing rules aren’t taken into
account during code execution.
Because these rules aren't enforced, developers who use Apex must take care that they don't inadvertently expose sensitive data that would normally be hidden from users by user permissions, field-level security, or organization-wide defaults. They should be particularly careful with Web services, which can be restricted by permissions, but execute in system context once they are initiated.
Most of the time, system context provides the correct behavior for
system-level operations such as triggers and Web services that need
access to all data in an organization. However, you can also specify
that particular Apex classes should enforce the sharing rules that
apply to the current user. (For more information on sharing rules, see
the Salesforce online help.)
Documentation