In our full sandbox, our QA engineer has observed that one of our Lightning Components is failing. Upon further inspection, it turns out that the Apex class the component is calling is not accessible by the running user. Adding permissions to the class for his security profile solved the problem.
However, the same code is running in production and only the admin profile has access to the Apex class. Yet, non-admin users can call the class via the Lightning Component without any problems.
I took a look at the Winter '21 release notes, but didn't see any mention of Apex Class Permissions. Any ideas why we are seeing these inconsistent results?