We can restrict components being loaded depending on whether they are inside an accessible page data or route, however when getting a collection of components, these will be accessible. Document how to implement your own security when getting a collection of components.