eBO issue

So we have discovered (you may already be aware) that when users do not have access to eBO, if they go to Reports, eBO reports, they cannot log into eBO….BUT if they use the URL to open eBO, they have full access to all reports, after entering their credentials (even though they do not have security settings access)! Has anyone else addressed this issue with eCW?  We have been told that there is no two-factor authentication on eBO through the URL, but happened to discover that users dont need access if they go in through the URL.  We were floored by this!
Anyone else ever addressed this?
Thanks,