Although Sitefinity will demand for permissions and filter viewable items for you if you follow the steps, you should be aware of the DataProviderBase.SuppressSecurityChecksproperty. It is not directly accessible through the manager, but it is still accessible through the active provider. If set to true, all security checks/demands/filtering will be off. You should respect this setting when implementing your own secured module. Sitefinity turns off security during project installation, so if you don't respect this setting, Sitefinity will fail to install.