Indeed, today it prefills all new segments, i.e. segments from merge too, so it prefills with original acl values which can be outdated if read access changed since then.

See SOLR-43