Yes, this is intentional. Keep in mind that accessing the local bundles Plex Web is not accessing your server. It’s just loading the Plex Web client. The free Plex content will be available to everyone, so even without singing in, it will be shown. You can turn this off for your account, and when you sign in, the client knows it’s you and will not show anything you’ve disabled.
This has been brought up in a few other threads and Plex is discussion internally if the local web should be accessible without signing in, but for now, this is working as intended.