ACL Record Restriction are not applying to Bar and Pie chart reports
The behavior of ACLs not applying to bar/pie charts is actually expected. In our official documentation we state the following below:
"ACLs control access to the underlying table data. List reports require the reporting user to satisfy ACLs on the target table to view records in the list. Users without sufficient permissions may see filtered list reports.
Reports that present aggregate data, such as pie or bar charts, do not require the user to satisfy target table ACLs to view the chart. These reports are not filtered due to security, though may be filtered by an on-query business rule defined for the target table. ACLs are required to view the list of records when you click a portion of a chart."
Often times this is overlooked in the product doc but this behavior is expected.