DefaultEscalatedSecurityContext does not (always) retain the authenticated user when running with elevated permissions

public class MyComponent {
    private final EscalatedSecurityContext withRead;

    public MyComponent(SecurityService securityService) {
        // bug: the run-as user is captured here, in this case null
        withRead = securityService.withPermission(Permission.REPO_READ, "some reason");
    }
    
    public void fancyLogicHere() {
        withRead.call(new UncheckedOperation<Void>() {
            public Void perform() {
                // bug: the 'null' run-as user captured in the constructor is set as the current user (but with REPO_READ permissions)
                ....
            }
        });
    }