Jira calendars are visible to non-project members

A Confluence user that isn't a member of a project in Jira can see a Jira calendar related with that project when adding a calender. However, if he adds the calender, dates from this calendar don't show up. But I'd expected that the non-project member doesn't see this project at all.

What's even worse is, that the non-project member has the choice to delete this project calendar for all users when he wants to remove that calendar again. And if he chooses to delete the calendar, the calendar is actually removed for all users.