Why user can access Custom Metadata Types without profile permission?

Question

I have got a query about Custom Metadata Types. I've created a Custom Metadata Type 'X' and using it inside a package(Doing a query from 'X'). But, I didn't give the 'Enabled Custom Metadata Type Access' from the profile for a specific user. However, that user can actually access the Custom Metadata 'X' from that package. Why is that? Why is he getting the access?

Answer 1

There are few settings around this:-

1. Restrict access to custom metadata types Allow access only through granted permissions and when accessing custom metadata types in system mode, for example, from Apex.

Read more here:- Control Read Access to Custom Metadata Types

2. Protection and Privacy Options for Custom Metadata Types For sensitive data, like application secrets, it’s important that custom metadata types are included in a managed package. When contained in a managed package and set to protected or package protected, they’re not visible to subscribing organizations, making it a good place to store certain kinds of secrets.
3. Behavior of Apex, Visualforce, and Aura Functionality that runs in system mode, such as Apex, is not affected by the Restrict access to custom metadata types org preference. Also, the with sharing modifier in the Apex class, doesn’t affect query behavior such as, isAccessible() and isCreatable(). If a field value is retrieved in Apex and assigned to a non-sObject variable, the behavior is the same whether the preference is enabled or not. When functionality is run in user mode, such as Visualforce Components, Visualforce Email templates, and Aura, you must have permission to access the custom metadata types. For example, without permission, the fields on Visualforce pages that you don't have access to aren’t displayed. The $Setup global variable (available in Visualforce and formulas) continues to load values by direct reference (meaning, data that is assigned to an sObject type) regardless of the running user.