Why a Postgres View Can Silently Bypass Row-Level Security

Querying a reporting view returned a project's real task counts to a user with zero membership in that project. Row-level security should have scoped that row out. It came back anyway, because the vie