Only one confirmed case so far but this could be catastrophic. 

I am the realm owner.

Our realm is set to make all new players Visitors. A new player entered and was able to build and interact with objects. The in-game permissions level showed the player as a Member (should be Visitor). I checked the player via the Realms management, outside of the game world and the player was shown as a Visitor. Upon reapplying the Visitor status in the Realm management, the player was moved to Visitor mode. 

The concern here is that others may join and have building rights when they should not have.