All the rest calls are not restricted by security settings. User is allowed to get org. units, repositories or projects by the rest calls. Also if building project is disabled, maven call of the user can do it.