Non-friends can join a friends-only world if they are using the same network

The bug

The "Online" Multiplayer option allows anyone using the same network to join, regardless of friend status. The host doesn't even get sent a world join request.

The setting's description — "Friends online can join." — seems to indicate that a player must be on your friend list in order to join.

How to reproduce

1. While in a world, go to Multiplayer Options and set "Multiplayer" to "Online"

2. Open another instance of the Launcher (leave the world running)

3. Log into a different account that is not friends with the first account

4. Click "Multiplayer" on the main menu
   ❌ The world is displayed in the server list (as "LAN World")

5. Attempt to join the world
   ❌ You are able to join the world

Expected behaviour

The world should not appear in the multiplayer server list. It should be impossible to join the world unless (1) you are friends with the host, and (2) the host accepts your request to join the world.