When querying a virtual document, it would check that the scope had permission to view the record, even though the record did not actually belong to a table.
Not it checks to see if the record is a virtual in-memory record, and does not perform any permissions checks if this is the case.