Project users shall have limited rights

In Zoho Books, under Timesheet, a user can be added to a Project.
The user's rights can be limited to view only using the roles settings.

The problem is that once I add a user to a project then that user can see all invoices, expenses and bills of the entire company. It would be great if he/she could only see the invoices, expenses and bills related to the project, to which he/she was given access to.

This needs an urgent fix to comply with data protection regulations.