The issue is that, in App.razor, it contains a <RouteView> instead of a <AuthorizeRouteView>. This happens because the condition in the sources looks like this:

@*#if (OrganizationalAuth || IndividualAuth)
        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)" />
#else
        <RouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)" />
#endif*@

The OrganizationalAuth || IndividualAuth criteria is wrong because it doesn't account for WindowsAuth.

To fix this, we could change the condition to if (!NoAuth) since that covers all the cases.

However since there's also a related bug in preview 9, #13374, we probably don't want to fix it like that. We probably want to change this file so it wraps a <CascadingAuthenticationState> around the whole file depending on the !NoAuth condition.