Access ProtectedRoute directly through address bar

Is it expected behaviour that a route which has been created using withAuthenticationRequired can be accessed by typing the name of the route directly into the address bar? This seems like it should not happen, but I am getting the route by doing so after logging out and back in a tutorial application.

The tutorial is an online one, as the cra-react-router application will not start after installing it’s node components.

(Error The react-scripts package provided by Create React App requires a dependency:

“eslint”: “^7.11.0”
)

Thanks for any advice,
Robert