[Zope] External methods, XML_RPC and security

Hi, Why is it possible to call an external method object even thou all access rights has been removed (including view). Best Regards, Johan Carlsson