GitLab pipeline leaks other project sources using submodules

I am exploring the capabilities of GitLab CI/CD in a private instance and I’m concerned about security with a specific use case: suppose I have a project with a .gitlab-ci.yml file. Is it right that any project developer can

• add a git submodule for another project using “relative” paths, maybe a project for which such developer doesn’t have permissions
• add a new pipeline job which creates a tar from the submodule path and set it as the artifact
• download the artifact and access the “private” project sources

I tried this and it seems to be feasible. Are there any way to prevent this?

Actually this is not true:

“The token has the same permissions to access the API as the user that caused the job to run. A user can cause a job to run by taking action like pushing a commit, triggering a manual job, or being the owner of a scheduled pipeline. Therefore, this user must be assigned to a role that has the required privileges.”