Currently, you are able to open a pull request that is targeting a branch other than the default (i.e. main) and you can deploy that branch while bypassing branch protection rules.

For example, you might have a branch protection rule on main that says a PR must be approved before it can be deployed. If you simply open a PR that targets a branch other than main, you would be able to deploy those changes without an approval.

Example:

gitGraph
    commit
    commit
    branch develop
    checkout develop
    commit
    commit
    branch bug-fix
    commit id: "fix error" type: HIGHLIGHT

In this example, you could not deploy any of the commits from the develop branch as they are trying to merge into the main branch which has a branch protection rule requiring passing CI, approvals, etc. However, if you open a PR from the bug-fix branch, you could .deploy the fix error commit without issues since it is not targeting a branch with branch protection (or rulesets).

This is a bug and it should be resolved.