@arnodoro – Apologies for the delay.
So the only scenario I can imagine where that happens is either if you enabled caching for logged in users that is shared by non-logged in users, or the leaked page was simply cached before the restrictions were activated and was not purged afterwards.
Otherwise if not serving cached pages to logged in users, assuming a purged cache, the first user to request the page causes the page to get cached the way they would have viewed it, and subsequent requests get the same copy.
So when set up properly leaking isn’t possible.
The only issues with caching and this plugin are things like if you restrict a posts content, then they go to the login page and instead of a redirect hit the back button after logging in. The browsers cached copy is used without requesting it again from the server, so they don’t see the changes without hitting refresh. But that isn’t what you are describing.
Hope that helps.