Question About Access to a Private Synonym Using A Public DB Link

 Hello:

In database sbd5, I added a public database link to sbq3 and then used it to create (what I believe) is a private synonym owned by user phoenix: 

create public database link SBQ3@PHXCURT connect to PHXCURT identified by <password> using SBQ3;
create or replace synonym PHOENIX.TBOM20 for PHXCURT.TBOM20@SBQ3@PHXCURT;

I was very surprised to find that a different user, phrpt, can also use this synonym and retrieve data from the remote database.
User phrpt has no privileges on phoenix objects in sbd5.  However, user phrpt does have select (through a role) on phxcurt.tbom20 in the remote database.