As far as I can tell this is not the case. MODX keeps track of what contexts you are logged in to.
It just seems to be the case, that when a user accesses a resource, MODX only checks whether this user has “view” permissions for this resource in the “web” context. And not if the user is actually logged in to the “web” context.
My guess is, that if you only want to show a resource to someone that is actually logged in to the “web” context, you have to do this check yourself in a (uncached) snippet (using the function $modx->user->isAuthenticated('web') or modx->user->hasSessionContext('web')).