Why can a learner recommend a course with no access?

Summary:

Our compliance training is strictly administrator enrollment only, and as such it is not visible in ESS/MSS. I am finding a list of people in our recent reporting who are showing as Not Started due to a colleague having recommended the course to them. It is skewing our reporting figures and from a UX perspective, this should not be possible for people to do - it defeats the point of setting courses to No Access. Is this a bug?

Content (please ensure you mask any confidential information):

Version (include the version you are using, if applicable):

24B

Code Snippet (add any code snippets that support your topic, if applicable):