Uninvited Users in Realm

I created a Realm for my son to play in with his friends. We use an ipad as do some of his friends, but some also have an Xbox.

From what I've read "You don't have to fear any random strangers invading your Realm. Only the friends you choose to invite can join."

I have to disagree with this statement as users without an invite ARE able to enter the realm.

If a player on an xbox has been invited to the realm and their sibling picks up the other controller, they can also enter the realm with their own gamertag even though they have not been personally invited.

We discovered this on the first time one of my sons friend entered the realm - he was on an xbox. His sister also came in. We thought we'd been hacked as I hadn't invited anyone with her gamertag and unlike members, her gamertag was greyed out in the members list, so there was no way to click and see her profile or get an option to block or boot her out.

Surely this is a bit of a loophole - is it common knowledge? Is this meant to be able to happen? Is there a way to avoid it and restrict the realm to invitees only?