I see the data sent in another BROKER without authentication... Why, if I use the authentication?

[fandres]

Hello friends, I am implementing a project that uses user / password authentication. The publisher is thus:
self.client_mqtt = MQTTClient (self.CLIENT_ID, BROKER, PORT, NAME, MQTT_PASS)

On the other hand the BROKER is running mosquitto, this works well. But I've done tests with another BROKER on my PC and another client on my PC with: mosquitto_sub -d -t / #
The problem is that the PC client and the PC BROKER shows the data.

Why, if I use the authentication by user / password (Publisher) can I see the data sent in another BROKER without authentication?
I am doing something wrong?

library: umqtt.simple
Micropython: 1.9.3 with ESP8266

[pythoncoder]

I think MQTT password protection is to protect the broker from rogue clients rather than to protect the client from rogue brokers.