Question:

Why a user is able to view the object records in the Flash Report even the user doesn't have view permission on the object records?

Answer:

By design, Vault does not require that flash report recipients have view permissions on the report’s underlying object records or documents to view the cached results.

As such, the user is able to view the object records in the Flash Report even the user doesn't have view permission on the object records.

Related Documentation:

N/A