Cube Data Access Security Troubleshoot

If a user is part of a security group with the below "Data Cell Access Security" filters, does that mean they would only have access to "Ent_3200"?  For some reason this user is still able to see all base entities however they are still restricted from TOP?

Why would the "E#TOP" filter be correctly restricted, but E#top.base not be restricted?