URE caches the list of products available for the restricted user. If you view what is visible just after the change of restrictions settings you may see a different results some times.
Do you receive complain from a real user or this is a result of your own tests?
Try to test restricted user view with another browser for example without changing settings and multiple re-logins under different user accounts. Will products be visible always for restricted user or not?
